Skip to content
OpenAdvisories

Package · Debian

node-js-yaml

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-84375

    js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large seque…

    nodeca js-yaml js-yaml node-js-yaml Debian Ubuntu npm
  • High 7.5
    CVE-2026-59869

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml js-yaml node-js-yaml Debian Ubuntu npm