Description
js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nodeca | js-yaml | >= 5.0.0, < 5.2.1, >= 3.0.0, < 3.15.1, >= 4.0.0, < 4.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-js-yaml | No fix yet | — |
| Ubuntu 26.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 25.10 | node-js-yaml | No fix yet | — |
| Ubuntu 24.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 22.04 LTS | node-js-yaml | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 18.04 LTS | node-js-yaml | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | dotnet8.0 +4 | 8.0.128-1.hum1 | RHSA-2026:26994 |
| Red Hat Hardened Images 1 | nodejs20 +6 | 20.20.2-1.hum1 | RHSA-2026:9455 |
| Red Hat Hardened Images 1 | nodejs20-npm | 10.8.2-1.20.20.2.1.hum1 | RHSA-2026:9455 |
| Red Hat Hardened Images 1 | nodejs22 +6 | 1:22.23.1-2.hum1 | RHSA-2026:35272 |
| Red Hat Hardened Images 1 | nodejs22-npm | 1:10.9.8-1.22.23.1.2.hum1 | RHSA-2026:35272 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 1:24.18.0-0.2.hum1 | RHSA-2026:34478 |
| Red Hat Hardened Images 1 | nodejs24-npm | 1:11.16.0-1.24.18.0.0.2.hum1 | RHSA-2026:34478 |
| Red Hat Hardened Images 1 | nodejs25 +6 | 25.9.0-1.1.hum1 | RHSA-2026:7378 |
| Red Hat Hardened Images 1 | nodejs25-npm | 11.12.1-1.25.9.0.1.1.hum1 | RHSA-2026:7378 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 1:26.4.0-1.3.hum1 | RHSA-2026:33866 |
| Red Hat Hardened Images 1 | nodejs26-npm | 1:11.17.0-1.26.4.0.1.3.hum1 | RHSA-2026:33866 |
| Red Hat Hardened Images 1 | rust +18 | 1.96.1-1.hum1 | RHSA-2026:34975 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.0.2.hum1 | RHSA-2026:34478 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 3:14.6.202.34-1.26.4.0.1.3.hum1 | RHSA-2026:33866 |
| Red Hat Hardened Images 1 | yarnpkg | 1.22.22-18.1.hum1 | RHSA-2026:7655 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | renovate | 44.3.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | js-yaml | >= 5.0.0, < 5.2.1 | 5.2.1 | GHSA-724g-mxrg-4qvm |
Advisories 9
- RHSA-2026:33866 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:34478 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:35272 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:7655 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7378 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:26994 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9455 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:34975 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2026-3221 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
References
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
- https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded
- https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
- https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a
- https://github.com/nodeca/js-yaml/releases/tag/3.15.1
- https://github.com/nodeca/js-yaml/releases/tag/4.3.1
- https://github.com/nodeca/js-yaml/releases/tag/5.2.1