chore(deps): update dependency js-yaml to v5.2.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
js-yaml	5.1.0 → 5.2.1

---

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

CVE-2026-53550 / GHSA-h67p-54hq-rp68

More information

Details

Summary

A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.
This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service.

Details

The issue is in merge handling inside lib/loader.js:

• storeMappingPair(...) iterates every element of a merge sequence when key tag is tag:yaml.org,2002:merge.
• For each element, it calls mergeMappings(...).
• mergeMappings(...) computes Object.keys(source) and performs _hasOwnProperty.call(destination, key) checks for each key.

When input is of the form:

a: &a {k0:0, k1:0, ..., kK:0}
b: {<<: [*a, *a, *a, ... repeated M times ...]}
all *a entries refer to the same anchored object. After the first merge, subsequent merges are semantically no-ops, but the parser still reprocesses all keys each time.
Resulting work is O(K * M), while input size is O(K + M), giving quadratic scaling as payload grows.
Relevant code path:
lib/loader.js in storeMappingPair(...) merge branch (keyTag === 'tag:yaml.org,2002:merge')
lib/loader.js mergeMappings(...)

Root cause

File: lib/loader.js
Function: storeMappingPair(state, _result, overridableKeys, keyTag, keyNode,
valueNode, startLine, startLineStart, startPos)
Lines: ~359-366

if (keyTag === 'tag:yaml.org,2002:merge') {
  if (Array.isArray(valueNode)) {
    for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {
      mergeMappings(state, _result, valueNode[index], overridableKeys);
    }
  } else {
    mergeMappings(state, _result, valueNode, overridableKeys);
  }
}

When the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each element
is handed to mergeMappings() without deduplication. mergeMappings() then does

sourceKeys = Object.keys(source);
for (index = 0; index < sourceKeys.length; index += 1) {
  key = sourceKeys[index];
  if (!_hasOwnProperty.call(destination, key)) {
    setProperty(destination, key, source[key]);
    overridableKeys[key] = true;
  }
}

Every alias reference in the sequence resolves (by design) to the SAME object
via state.anchorMap. After the first merge, every subsequent merge of that same
reference is a pure no-op semantically, but still performs:

• one Object.keys(source) call (O(K))
• K _hasOwnProperty.call checks on the destination

Total: M * K hasOwnProperty checks + M Object.keys allocations, while the final
object and all observable side effects are identical to a single merge.

YAML semantics for <<: are idempotent and commutative over duplicate sources,
so collapsing duplicates preserves behavior exactly; this isn't a spec trade-off.

PoC

Environment:
js-yaml version: 4.1.1
Node.js: v24.5.0
Platform: arm64 macOS (reproduced consistently)
Reproduction script:
Create many keys in one anchored map (&a).
Merge that same alias repeatedly via <<: [*a, *a, ...].
Measure parse time and compare with control payload using single merge (<<: *a).
Observed repeated runs (same machine):
K=M=1000, input 9,909 bytes: ~33–36 ms
K=M=2000, input 20,909 bytes: ~121–123 ms
K=M=4000, input 42,909 bytes: ~524–537 ms
K=M=6000, input 64,909 bytes: ~1,608–1,829 ms
K=M=8000, input 86,909 bytes: ~3,395–3,565 ms
Control (single merge, similar key counts):
K=2000: ~1–2 ms
K=4000: ~3 ms
K=8000: ~5 ms
Also verified: repeated-merge output equals single-merge output (same key count and same JSON), confirming excess time is redundant computation.

Impact

This is a denial-of-service vulnerability (CPU exhaustion / algorithmic complexity).
Any service parsing untrusted YAML with js-yaml can be impacted, including API backends, CI tools, config processors, and automation services. An attacker can submit crafted YAML to significantly increase CPU time and reduce availability.

Suggested fix:

Dedupe the merge source list by reference before invoking mergeMappings. Any of
the following are minimal and preserve YAML 1.1 merge semantics:

dedupe in storeMappingPair:

if (keyTag === 'tag:yaml.org,2002:merge') {
  if (Array.isArray(valueNode)) {
    var seen = new Set();
    for (index = 0, quantity = valueNode.length; index < quantity; index += 1) {
      var src = valueNode[index];
      if (seen.has(src)) continue;   // idempotent; skip redundant alias
      seen.add(src);
      mergeMappings(state, _result, src, overridableKeys);
    }
  } else {
    mergeMappings(state, _result, valueNode, overridableKeys);
  }
}

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68
• https://nvd.nist.gov/vuln/detail/CVE-2026-53550
• https://github.com/advisories/GHSA-h67p-54hq-rp68

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

CVE-2026-59870 / GHSA-724g-mxrg-4qvm

More information

Details

Summary

js-yaml v5.x introduces YAML11_SCHEMA support with the !!omap (ordered map) tag. The omapTag.addItem() function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses yaml.load() with { schema: yaml.YAML11_SCHEMA }.

Details

In src/tag/sequence/omap.ts (compiled: dist/js-yaml.cjs.js:510-525):

var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {
    create: () => [],
    addItem: (container, item) => {
        // ...
        for (const existing of container)   // O(n) per insertion!
            if (hasOwnProperty(existing, itemKeys[0]))
                return 'cannot resolve an ordered map item';
        container.push(object);             // n insertions → O(n^2) total
        return '';
    }
});

For a document with n unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = O(n²) total work.

PoC (runtime-confirmed on v5.2.0)

const yaml = require('js-yaml');
function buildOmapPayload(n) {
  let p = '!!omap\n';
  for (let i = 0; i < n; i++) p += '- key' + i + ': val' + i + '\n';
  return p;
}
// Timing results on v5.2.0:
// n=1000:  9ms
// n=5000:  73ms  (5x n → 8x time)
// n=10000: 255ms (2x n → 3.5x time — supralinear)
// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)
// n=50000: 10613ms          ← blocks event loop for >10 seconds
yaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });

Impact

Any application that parses untrusted YAML using yaml.load(input, { schema: yaml.YAML11_SCHEMA }) is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).

This affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including !!omap. The 4.x series is unaffected (no YAML11_SCHEMA export).

Fix

Replace the O(n) linear scan in addItem with an O(1) Set-based lookup:

var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {
    create: () => ({ list: [], seen: new Set() }),
    addItem: (state, item) => {
        const key = Object.keys(item)[0];
        if (state.seen.has(key)) return 'duplicate omap key';
        state.seen.add(key);
        state.list.push(item);
        return '';
    },
    resolve: (state) => state.list
});

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
• https://nvd.nist.gov/vuln/detail/CVE-2026-59870
• https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
• https://github.com/nodeca/js-yaml/releases/tag/5.2.1
• https://github.com/advisories/GHSA-724g-mxrg-4qvm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

CVE-2026-59868 / GHSA-g796-fgmg-93mv

More information

Details

Impact

This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default

When merge keys (<<) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:

a0: &a0 { k0: 0 }
a1: &a1 { <<: *a0, k1: 1 }
a2: &a2 { <<: *a1, k2: 2 }
a3: &a3 { <<: *a2, k3: 3 }
...
b: *aN

For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.

PoC

From N = 4000 delay become > 1s (doc size < 100K)

import { performance } from 'node:perf_hooks'
import { Buffer } from 'node:buffer'
import { load, YAML11_SCHEMA } from 'js-yaml'

const n = Number(process.argv[2] || 4000)

function makeMergeChain (count) {
  const lines = ['a0: &a0 { k0: 0 }']

  for (let i = 1; i < count; i++) {
    lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`)
  }

  lines.push(`b: *a${count - 1}`)
  return `${lines.join('\n')}\n`
}

const source = makeMergeChain(n)

console.log(source.split('\n').slice(0, 8).join('\n'))
console.log('...')
console.log(source.split('\n').slice(-4).join('\n'))
console.log()
console.log(`N: ${n}`)
console.log(`YAML size: ${Buffer.byteLength(source)} bytes`)

const started = performance.now()
const result = load(source, { schema: YAML11_SCHEMA })
const elapsed = performance.now() - started

console.log(`parse time: ${elapsed.toFixed(1)} ms`)
console.log(`top-level keys: ${Object.keys(result).length}`)
console.log(`b keys: ${Object.keys(result.b).length}`)

Patches

Fix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv
• https://nvd.nist.gov/vuln/detail/CVE-2026-59868
• https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
• https://github.com/nodeca/js-yaml/releases/tag/5.2.0
• https://github.com/advisories/GHSA-g796-fgmg-93mv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nodeca/js-yaml (js-yaml)

v5.2.1

Compare Source

Fixed

• Add Map support to !!omap (should work when realMapTag used)

Security

• Remove quadratic complexity from !!omap addItem. Regression from v5
  (usually not critical, because YAML11_SCHEMA is not default anymore).

v5.2.0

Compare Source

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of
  keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per
  document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge
  processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for jestjs ready!

Name	Link
🔨 Latest commit	9455480
🔍 Latest deploy log	https://app.netlify.com/projects/jestjs/deploys/6a5e94982171d3000730e378
😎 Deploy Preview	https://deploy-preview-16287--jestjs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[pkg-pr-new]

Open in StackBlitz

babel-jest

npm i https://pkg.pr.new/babel-jest@16287

babel-plugin-jest-hoist

npm i https://pkg.pr.new/babel-plugin-jest-hoist@16287

babel-preset-jest

npm i https://pkg.pr.new/babel-preset-jest@16287

create-jest

npm i https://pkg.pr.new/create-jest@16287

@jest/diff-sequences

npm i https://pkg.pr.new/@jest/diff-sequences@16287

expect

npm i https://pkg.pr.new/expect@16287

@jest/expect-utils

npm i https://pkg.pr.new/@jest/expect-utils@16287

jest

npm i https://pkg.pr.new/jest@16287

jest-changed-files

npm i https://pkg.pr.new/jest-changed-files@16287

jest-circus

npm i https://pkg.pr.new/jest-circus@16287

jest-cli

npm i https://pkg.pr.new/jest-cli@16287

jest-config

npm i https://pkg.pr.new/jest-config@16287

@jest/console

npm i https://pkg.pr.new/@jest/console@16287

@jest/core

npm i https://pkg.pr.new/@jest/core@16287

@jest/create-cache-key-function

npm i https://pkg.pr.new/@jest/create-cache-key-function@16287

jest-diff

npm i https://pkg.pr.new/jest-diff@16287

jest-docblock

npm i https://pkg.pr.new/jest-docblock@16287

jest-each

npm i https://pkg.pr.new/jest-each@16287

@jest/environment

npm i https://pkg.pr.new/@jest/environment@16287

jest-environment-jsdom

npm i https://pkg.pr.new/jest-environment-jsdom@16287

@jest/environment-jsdom-abstract

npm i https://pkg.pr.new/@jest/environment-jsdom-abstract@16287

jest-environment-node

npm i https://pkg.pr.new/jest-environment-node@16287

@jest/expect

npm i https://pkg.pr.new/@jest/expect@16287

@jest/fake-timers

npm i https://pkg.pr.new/@jest/fake-timers@16287

@jest/get-type

npm i https://pkg.pr.new/@jest/get-type@16287

@jest/globals

npm i https://pkg.pr.new/@jest/globals@16287

jest-haste-map

npm i https://pkg.pr.new/jest-haste-map@16287

jest-jasmine2

npm i https://pkg.pr.new/jest-jasmine2@16287

jest-leak-detector

npm i https://pkg.pr.new/jest-leak-detector@16287

jest-matcher-utils

npm i https://pkg.pr.new/jest-matcher-utils@16287

jest-message-util

npm i https://pkg.pr.new/jest-message-util@16287

jest-mock

npm i https://pkg.pr.new/jest-mock@16287

@jest/pattern

npm i https://pkg.pr.new/@jest/pattern@16287

jest-phabricator

npm i https://pkg.pr.new/jest-phabricator@16287

jest-regex-util

npm i https://pkg.pr.new/jest-regex-util@16287

@jest/reporters

npm i https://pkg.pr.new/@jest/reporters@16287

jest-resolve

npm i https://pkg.pr.new/jest-resolve@16287

jest-resolve-dependencies

npm i https://pkg.pr.new/jest-resolve-dependencies@16287

jest-runner

npm i https://pkg.pr.new/jest-runner@16287

jest-runtime

npm i https://pkg.pr.new/jest-runtime@16287

@jest/schemas

npm i https://pkg.pr.new/@jest/schemas@16287

jest-snapshot

npm i https://pkg.pr.new/jest-snapshot@16287

@jest/snapshot-utils

npm i https://pkg.pr.new/@jest/snapshot-utils@16287

@jest/source-map

npm i https://pkg.pr.new/@jest/source-map@16287

@jest/test-result

npm i https://pkg.pr.new/@jest/test-result@16287

@jest/test-sequencer

npm i https://pkg.pr.new/@jest/test-sequencer@16287

@jest/transform

npm i https://pkg.pr.new/@jest/transform@16287

@jest/types

npm i https://pkg.pr.new/@jest/types@16287

jest-util

npm i https://pkg.pr.new/jest-util@16287

jest-validate

npm i https://pkg.pr.new/jest-validate@16287

jest-watcher

npm i https://pkg.pr.new/jest-watcher@16287

jest-worker

npm i https://pkg.pr.new/jest-worker@16287

pretty-format

npm i https://pkg.pr.new/pretty-format@16287

commit: 9455480