GHSA-r3ph-w7gj-g6xm: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

September 29, 2026

maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.

References

github.com/advisories/GHSA-r3ph-w7gj-g6xm
github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
github.com/nodeca/js-yaml/releases/tag/5.4.1
github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm

Code Behaviors & Features

Detect and mitigate GHSA-r3ph-w7gj-g6xm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →