Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| js-yaml | npm | >= 4.0.0, <= 4.1.1 | 4.2.0 |
| js-yaml | npm | < 3.15.0 | 3.15.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a quadratic-complexity Denial of Service in the js-yaml library, caused by inefficient handling of repeated aliases in YAML merge keys. The core of the issue lies in the storeMappingPair function within lib/loader.js. When processing a merge (<<) tag with a sequence of aliases, the function iterates through each alias and calls the mergeMappings function to perform the merge. However, the original implementation did not deduplicate the aliases.
If an attacker provides a YAML document with a merge sequence containing many repetitions of the same alias (e.g., [ *a, *a, *a, ... ]), the storeMappingPair function would call the computationally expensive mergeMappings function for each repetition. The mergeMappings function, in turn, iterates over all keys of the source object. This leads to an O(M * K) complexity, where M is the number of repeated aliases and K is the number of keys in the aliased object, resulting in a quadratic-time algorithm that can be exploited to cause a denial of service by consuming excessive CPU resources with a small payload.
The patch mitigates this by introducing a Set to track the processed source objects within storeMappingPair, ensuring that mergeMappings is only called once for each unique object, thus reducing the complexity to linear time and preventing the DoS.
storeMappingPairlib/loader.js
mergeMappingslib/loader.js