js-yaml 4.3.1 Denial of Service: Malformed Input Hangs YAML Parser

The Vulnerability Explained

js-yaml is a widely-used JavaScript YAML parser found in thousands of Node.js projects—everywhere from build tools to configuration loaders to API request handlers. The parser accepts YAML strings and transforms them into JavaScript objects, and it was designed to be robust and standards-compliant.

However, versions up to 4.3.1 contain a critical flaw: when processing certain kinds of malformed YAML input, the parser enters a state where it loops indefinitely or performs unbounded work without ever reaching a termination condition. This means a single carefully-crafted YAML payload can hang the entire process.

Here's why this matters in practice: if your Express server or Fastify service accepts YAML in a request body, or if your CLI tool parses YAML configuration files, an attacker can send one malformed document and halt all concurrent requests. Every connection queued behind the hung parser starves. Database operations block. Message queues pile up. The process exhausts memory or hits timeouts, and eventually crashes or becomes unreachable.

The vulnerable code path is the internal token or node processing loop that handles ambiguous or nested structures in malformed input. When the parser encounters an input structure that violates the YAML spec in a specific way, the loop condition that should terminate the parse never evaluates to true, and the parser spins indefinitely.

Affected Versions

Affected	4.3.1, 3.15.1 and earlier
Fixed in	4.3.2, 3.15.2
Ecosystem	npm
CVE / GHSA	CVE-2026-84375 / N/A
CWE	N/A

The Fix

The patch introduces bounds checking and loop termination logic to the YAML parser's internal state machine. The fix ensures that:

1. Parser loop termination: The parse loop now has explicit guards that prevent infinite iteration even when input is malformed.
2. Resource limits: Processing of deeply nested or ambiguous YAML structures now respects configurable limits rather than accepting arbitrary depth.
3. Input validation: Malformed token sequences that previously bypassed validation are now rejected early with a clear error rather than passed to the recursive parser.

The version upgrade from 4.3.1 to 4.3.2 carries these fixes without any API changes. The same applies to the 3.x line, where 3.15.2 addresses the same root cause.

Because this is a lockfile-based fix through the dependency tree, the actual parsing code changes are internal to js-yaml itself. Your application does not require code changes—only a dependency upgrade.

Attack Scenario

An attacker who can control input to your application's YAML parsing path can exploit this vulnerability:

1. The attacker crafts a malformed YAML document designed to trigger the unbounded loop.
2. They send this document via an HTTP POST request, file upload, or other input channel that reaches parse() or load().
3. The parser hangs indefinitely, blocking the worker thread or process.
4. Concurrent requests queue up behind the blocked parser, eventually exhausting connection pools and causing cascading failures.
5. The application becomes unresponsive; clients experience timeouts; monitoring alerts fire; incident response is triggered.

This is a classic denial of service attack with minimal attacker effort and maximum impact.

Key Takeaways

• js-yaml 4.3.1 hangs on specific malformed YAML input: Not all malformed YAML triggers this—only particular patterns in the token stream. But you cannot safely assume your input won't hit the pattern unless you control it entirely.
• The hang is unbounded: There is no timeout, no progress, no logging of what went wrong. The process is silently hung from the attacker's perspective.
• Upgrade urgently if you parse untrusted YAML: Configuration loaders that only read files you control are lower risk, but any YAML that flows through a network boundary or comes from a database should be parsed with the patched version.
• Lockfile updates alone are not enough: Ensure your CI/CD or dependency manager re-locks after upgrading js-yaml. If your build still pulls 4.3.1 from an old cached lockfile, you remain vulnerable.

How Orbis AppSec Detected This

Source: Untrusted YAML input passed to js-yaml.parse() or js-yaml.load() methods in any dependency within the application tree.

Sink: The internal YAML tokenizer and parser state machine that processes the input string without sufficient loop termination guards.

Missing control: Bounds checking and loop termination logic in the parser's handling of malformed token sequences; no maximum iteration count or depth limit on recursive parsing.

CWE: Unknown—this is a specific parser logic flaw rather than a well-catalogued vulnerability class.

Fix: Upgrade js-yaml to 4.3.2 (v4 line) or 3.15.2 (v3 line), which adds loop termination guards and input validation to prevent unbounded parsing.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-84375 is a straightforward but impactful denial of service vulnerability: a flaw in the YAML parser's loop termination logic allows malformed input to hang the application indefinitely. Because YAML parsing is so common in Node.js tooling and configuration pipelines, and because attackers can often reach the parser via HTTP, file uploads, or external APIs, this vulnerability has wide real-world exposure.

The fix is simple: upgrade js-yaml to 4.3.2 or 3.15.2. Both releases maintain full backward compatibility while closing the parser hang. Check your lockfile today, run npm update js-yaml, and verify in your CI that the new version is locked. Your application's availability depends on it.