Skip to content
OpenAdvisories

Package · Debian

node-js-yaml

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-53550

    js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

    js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic pa…

    nodeca js-yaml js-yaml node-js-yaml Debian Ubuntu npm
  • Medium 5.3
    CVE-2025-64718

    js-yaml has prototype pollution in merge (<<)

    js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documen…

    nodeca js-yaml js-yaml node-js-yaml Debian Ubuntu npm