js-yaml npm Package Vulnerability: What We Know
- Severity
- HIGH
- Affected component
- js-yaml (npm)
- Affected versions
- >= 4.0.0, < 4.3.2 or >= 3.0.0, < 3.15.2 or < 3.13.0 or >= 3.0.0, < 3.15.0 or >= 4.0.0, < 4.3.0 or >= 4.0.0, < 4.3.1 or >= 3.0.0, < 3.15.1 or >= 5.0.0, < 5.2.1 or < 3.13.1 or >= 5.0.0, < 5.2.0 or >= 4.0.0, < 4.2.0 or < 3.15.0 or >= 4.0.0, < 4.1.1 or < 3.14.2 or >= 5.0.0, < 5.2.2 or < 2.0.5
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the js-yaml npm package. This vulnerability, which is under investigation, could allow an attacker to cause prolonged CPU consumption.
What happened
An early warning has been issued regarding a vulnerability in the js-yaml npm package. The vulnerability reportedly lies in the `maxTotalMergeKeys` parameter, which does not count empty mappings. This oversight allows an attacker to repeatedly merge a large sequence of empty mappings, consuming significant CPU without reaching the configured limit. The issue has been flagged but is not yet confirmed. The vulnerability is tracked under GHSA-2883-XCG3-V3HH and has a high severity rating.
The affected versions of js-yaml are >= 4.0.0, < 4.3.2 or >= 3.0.0, < 3.15.2 or < 3.13.0 or >= 3.0.0, < 3.15.0 or >= 4.0.0, < 4.3.0 or >= 4.0.0, < 4.3.1 or >= 3.0.0, < 3.15.1 or >= 5.0.0, < 5.2.1 or < 3.13.1 or >= 5.0.0, < 5.2.0 or >= 4.0.0, < 4.2.0 or < 3.15.0 or >= 4.0.0, < 4.1.1 or < 3.14.2 or >= 5.0.0, < 5.2.2 or < 2.0.5. Users of these versions should assess their exposure and take appropriate action.
What to do about it
- Upgrade to the latest version of js-yaml that includes the fix for this issue.
- Check your project dependencies for any versions of js-yaml that fall within the affected range.
- If you are using an affected version, plan to upgrade as soon as a patched version is available.
- Monitor the primary sources for updates on the vulnerability and any released patches.
How 0Day would have caught this
js-yaml is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using js-yaml npm package versions >= 4.0.0, < 4.3.2 or >= 3.0.0, < 3.15.2 or < 3.13.0 or >= 3.0.0, < 3.15.0 or >= 4.0.0, < 4.3.0 or >= 4.0.0, < 4.3.1 or >= 3.0.0, < 3.15.1 or >= 5.0.0, < 5.2.1 or < 3.13.1 or >= 5.0.0, < 5.2.0 or >= 4.0.0, < 4.2.0 or < 3.15.0 or >= 4.0.0, < 4.1.1 or < 3.14.2 or >= 5.0.0, < 5.2.2 or < 2.0.5.
What should I do right now?
Check your project dependencies for any affected versions of js-yaml and plan to upgrade to a patched version as soon as it is available. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates on any released patches.