CVE-2026-84375 GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources (4.3.1 -> 4.3.2)

[dependabot]

Bumps js-yaml from 4.3.1 to 4.3.2 in openam-ui/openam-ui-ria (package.json and package-lock.json), clearing Dependabot alert #323 for this lock file.

Advisory

CVE-2026-84375 / GHSA-2883-xcg3-v3hh — Uncontrolled Resource Consumption (CWE-400) through Inefficient Algorithmic Complexity (CWE-407) in js-yaml 3.x before 3.15.2 and 4.x before 4.3.2. maxTotalMergeKeys, the budget that bounds the work a YAML merge key (<<) may cause, does not count empty mappings: a document which aliases one sequence of N empty mappings {} and merges it K times makes the loader do O(N·K) work while the budget never moves — ~500 KB of YAML keeps the parser busy for ~13 s. In 3.x and 4.x merge keys are enabled by default, which is why the score is high. 4.3.2 backports the fix from 5.4.1 (nodeca/js-yaml#797): every merge-source mapping counts as one budget unit besides its keys, and a merge sequence is hard-limited to 100 entries.

Severity	High — CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected	js-yaml >= 4.0.0, < 4.3.2 (and >= 3.0.0, < 3.15.2)
Fixed in	4.3.2 (3.15.2)

Impact on OpenAM

None at runtime, low in the build. js-yaml sits in devDependencies of openam-ui-ria only so that overrides can force the single 4.x copy onto eslint, grunt and mocha (which ask for 3.x) — no OpenAM source imports it and it does not ship in the WAR. Those tools would parse YAML only for a .eslintrc.yml, a .mocharc.yml or a grunt.file.readYAML() call; the RIA build has .eslintrc.js / src/test/.eslintrc.json, no .mocharc, and its Gruntfile.js reads no YAML, so no YAML document is parsed during the build at all, let alone one from outside the tree. The bump takes the dev toolchain out of the vulnerable range.

Change

^4.3.1 → ^4.3.2 in package.json, and the matching node_modules/js-yaml entry in package-lock.json (4.3.2, dev: true). No code or behaviour change; the overrides block is untouched, so eslint, grunt and mocha keep resolving to the same single copy.

Verified:

• the lock file integrity matches npm view js-yaml@4.3.2 dist.integrity
• CI is green on every leg (ubuntu 11/17/21/25/26, macOS 11/26, Windows 11/26, docker, CodeQL)

Not covered: openam-ui/openam-ui-api/package-lock.json still resolves js-yaml 4.3.1 through its overrides: "js-yaml": "^4.3.0" (alert #321) and needs its own lock refresh.

References

• GHSA-2883-xcg3-v3hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-84375
• fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797
• nodeca/js-yaml@d90b661 (backport to 4.3.2)
• nodeca/js-yaml@4.3.1...4.3.2