CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

🗓️ 01 Sep 2026 21:43:13Reported by GoogleType

osv-cve🔗 osv.dev👁 89 Views

js-yaml 3.0.0-3.15.2/4.3.2 DoS via empty merge key aliases bypassing maxTotalMergeKeys limit.

Reporter	Title	Published	Views	Family All 354
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Automation Workflow	15 Oct 202607:51	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Oct 202615:38	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	9 Oct 202613:28	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in js-yaml	5 Oct 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026	2 Oct 202617:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an uncontrolled resource consumption due to js-yaml (CVE-2026-84375)	15 Oct 202621:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	9 Sep 202616:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in js-yaml (CVE-2026-84375)	15 Oct 202620:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository	15 Oct 202616:58	–	ibm
Chainguard	CVE-2026-84375 vulnerabilities	10 Sep 202608:54	–	cgr

Source	Link
github	www.github.com/nodeca/js-yaml/releases/tag/3.15.2
github	www.github.com/nodeca/js-yaml/releases/tag/4.3.2
github	www.github.com/nodeca/js-yaml/releases/tag/5.4.1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84375.json
github	www.github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-84375
github	www.github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639
github	www.github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
github	www.github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b
github	www.github.com/nodeca/js-yaml/pull/797

30 Sep 2026 03:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00541

js-yaml merge key resource exhaustion maxTotalMergeKeys CPU DoS empty mappings