Mazze93

**Name of the Vulnerable Software and Affected Versions** js-yaml versions 5.0.0 through 5.1.x **Description** When merge keys are enabled, the software is susceptible to a Denial of Service (DoS) due to algorithmic complexity. Specifically, the parser can spend quadratic CPU time processing a document that grows only linearly in size. This occurs when a chain of mappings is used where each mapping merges the previous one, forcing the loader to enumerate inherited keys repeatedly. This results in O(N^2) work for an O(N) input size. **Recommendations** Update js-yaml to version 5.2.0. As a temporary mitigation, disable the use of merge keys during parsing.

**Name of the Vulnerable Software and Affected Versions** js-yaml versions 3.0.0 through 3.14.x js-yaml versions 4.0.0 through 4.2.x **Description** js-yaml can consume quadratic CPU time when parsing a document that grows linearly in size. This occurs when a chain of mappings utilizes merge keys, where each subsequent mapping merges the previous one. **Recommendations** Update js-yaml versions 3.0.0 through 3.14.x to version 3.15.0. Update js-yaml versions 4.0.0 through 4.2.x to version 4.3.0.