diff --git a/dist/index.js b/dist/index.js
index 88f2ccc..8e5e9c8 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -42359,19 +42359,28 @@ function captureSegment (state, start, end, checkJson) {
   }
 }
 
+function chargeMergeWork (state) {
+  state.totalMergeKeys++
+
+  if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+    throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
+  }
+}
+
 function mergeMappings (state, destination, source, overridableKeys) {
   if (!common.isObject(source)) {
     throwError(state, 'cannot merge mappings; the provided source object is unacceptable')
   }
 
+  // Count the source mapping itself to bound sequences of empty mappings.
+  chargeMergeWork(state)
+
   const sourceKeys = Object.keys(source)
 
   for (let index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     const key = sourceKeys[index]
 
-    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')')
-    }
+    chargeMergeWork(state)
 
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key])
@@ -42414,6 +42423,10 @@ function storeMappingPair (state, _result, overridableKeys, keyTag, keyNode, val
 
   if (keyTag === 'tag:yaml.org,2002:merge') {
     if (Array.isArray(valueNode)) {
+      if (valueNode.length > 100) {
+        throwError(state, 'abnormal merge sequence size')
+      }
+
       for (let index = 0, quantity = valueNode.length; index < quantity; index += 1) {
         mergeMappings(state, _result, valueNode[index], overridableKeys)
       }
diff --git a/package-lock.json b/package-lock.json
index 0b8b07f..cd644f9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,6 @@
         "@aws-sdk/client-s3": "3.1019.0",
         "@smithy/node-http-handler": "4.4.5",
         "https-proxy-agent": "7.0.6",
-        "js-yaml": "^4.2.0",
         "zod": "^4.1.12"
       },
       "devDependencies": {
@@ -35,7 +34,7 @@
         "husky": "9.1.7",
         "jest": "30.2.0",
         "jest-circus": "30.2.0",
-        "js-yaml": "4.3.1",
+        "js-yaml": "4.3.2",
         "lint-staged": "16.2.7",
         "prettier": "3.6.2",
         "ts-jest": "29.4.5",
@@ -1924,9 +1923,9 @@
       }
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7913,9 +7912,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index e3d9d7e..0becfe0 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "@aws-sdk/client-s3": "3.1019.0",
     "@smithy/node-http-handler": "4.4.5",
     "https-proxy-agent": "7.0.6",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "zod": "^4.1.12"
   },
   "devDependencies": {
@@ -54,7 +54,7 @@
     "husky": "9.1.7",
     "jest": "30.2.0",
     "jest-circus": "30.2.0",
-    "js-yaml": "4.3.1",
+    "js-yaml": "4.3.2",
     "lint-staged": "16.2.7",
     "prettier": "3.6.2",
     "ts-jest": "29.4.5",