Skip to content
OpenAdvisories

Package · Ubuntu

node-js-yaml

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-59868

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml js-yaml node-js-yaml Ubuntu npm
  • Medium 5.3
    CVE-2026-53550

    js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

    js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic pa…

    nodeca js-yaml js-yaml node-js-yaml Debian Ubuntu npm
  • Medium 5.3
    CVE-2025-64718

    js-yaml has prototype pollution in merge (<<)

    js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documen…

    nodeca js-yaml js-yaml node-js-yaml Debian Ubuntu npm