CVE-2026-84375 GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources in openam-ui-api (4.3.1 -> 4.3.2)

[vharseko]

Bumps js-yaml from 4.3.1 to 4.3.2 in openam-ui/openam-ui-api (package.json overrides and package-lock.json), clearing Dependabot alert #321 for this lock file.

Completes #1125, which applied the same fix to openam-ui-ria and noted that this module still resolved 4.3.1 through its overrides: "js-yaml": "^4.3.0".

Advisory

CVE-2026-84375 / GHSA-2883-xcg3-v3hh — Uncontrolled Resource Consumption (CWE-400) through Inefficient Algorithmic Complexity (CWE-407) in js-yaml 3.x before 3.15.2 and 4.x before 4.3.2. maxTotalMergeKeys, the budget that bounds the work a YAML merge key (<<) may cause, does not count empty mappings: a document which aliases one sequence of N empty mappings {} and merges it K times makes the loader do O(N·K) work while the budget never moves — ~500 KB of YAML keeps the parser busy for ~13 s. In 3.x and 4.x merge keys are enabled by default, which is why the score is high. 4.3.2 backports the fix from 5.4.1 (nodeca/js-yaml#797).

Severity	High — CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected	js-yaml >= 4.0.0, < 4.3.2 (and >= 3.0.0, < 3.15.2)
Fixed in	4.3.2 (3.15.2)

Impact on OpenAM

None at runtime, low in the build. In openam-ui-api js-yaml is a dev-scope transitive dependency of grunt@1.6.2 (which asks for ~3.14.0) and is held at 4.x only by the overrides entry — no OpenAM source imports it and it does not ship in the WAR. grunt would parse YAML only for a grunt.file.readYAML() call, and openam-ui-api/Gruntfile.js reads no YAML at all, so no YAML document is parsed during the build. The bump takes the dev toolchain out of the vulnerable range.

Change

overrides."js-yaml": ^4.3.0 → ^4.3.2 in package.json (so the floor matches the patched version, as #1100 did for ^4.3.0), and the matching node_modules/js-yaml entry in package-lock.json (4.3.2, dev: true). No code or behaviour change.

Verified:

• the lock file integrity matches npm view js-yaml@4.3.2 dist.integrity
• npm install --package-lock-only --prefer-online is a no-op, so the build will not roll the version back
• npm audit --package-lock-only no longer reports js-yaml for this module

References

• GHSA-2883-xcg3-v3hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-84375
• fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797
• nodeca/js-yaml@4.3.1...4.3.2