Description
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nodeca | js-yaml | >= 3.0.0, < 3.15.0, >= 4.0.0, < 4.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-js-yaml | 4.2.0+~4.0.9-2 | — |
| Debian 13 | node-js-yaml | No fix yet | — |
| Debian 12 | node-js-yaml | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-js-yaml | No fix yet | — |
| Ubuntu 26.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 25.10 | node-js-yaml | No fix yet | — |
| Ubuntu 24.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 22.04 LTS | node-js-yaml | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 18.04 LTS | node-js-yaml | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rh-podman-desktop | 1.1.2-1.el10_2 | RHSA-2026:57590 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | dotnet-hostfxr-8.0 +7 | 8.0.28-1.1.hum1 | RHSA-2026:40415, RHSA-2026:37577 |
| Red Hat Hardened Images 1 | dotnet8.0 +4 | 8.0.128-1.1.hum1 | RHSA-2026:40415, RHSA-2026:37577 |
| Red Hat Hardened Images 1 | nodejs22 +6 | 22.23.1-2.1.hum1 | RHSA-2026:38304 |
| Red Hat Hardened Images 1 | nodejs22-npm | 10.9.8-1.22.23.1.2.1.hum1 | RHSA-2026:38304 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.18.0-0.3.hum1 | RHSA-2026:38236 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.16.0-1.24.18.0.0.3.hum1 | RHSA-2026:38236 |
| Red Hat Hardened Images 1 | nodejs25 +6 | 25.9.0-1.3.hum1 | RHSA-2026:37534 |
| Red Hat Hardened Images 1 | nodejs25-npm | 11.12.1-1.25.9.0.1.3.hum1 | RHSA-2026:37534 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.4.0-1.4.hum1 | RHSA-2026:37532 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.17.0-1.26.4.0.1.4.hum1 | RHSA-2026:37532 |
| Red Hat Hardened Images 1 | rust +18 | 1.97.0-1.1.hum1 | RHSA-2026:38187 |
| Red Hat Hardened Images 1 | v8-12.4-devel | 12.4.254.21-1.22.23.1.2.1.hum1 | RHSA-2026:38304 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 13.6.233.17-1.24.18.0.0.3.hum1 | RHSA-2026:38236 |
| Red Hat Hardened Images 1 | v8-14.1-devel | 14.1.146.11-1.25.9.0.1.3.hum1 | RHSA-2026:37534 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.4.0.1.4.hum1 | RHSA-2026:37532 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-sqlparse | 0.6.0-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.33-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-8.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260923-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.14-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.60-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-sqlparse | 0.6.0-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114, RHSA-2026:71113 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.76.7.0.git145.b60ef1146-1.1 | openSUSE-SU-2026:12070-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.11-r0 | — |
| Wolfi rolling | code-server | 4.130.0-r1 | — |
| Wolfi rolling | eslint | 10.8.0-r1 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-suggestion-hyperopt | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r25 | — |
| Wolfi rolling | lerna | 9.0.7-r11 | — |
| Wolfi rolling | opensearch-dashboards-3 +1 | 3.7.0-r10 | — |
| Wolfi rolling | prism | 5.16.0-r1 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.253.0-r2 | — |
| Wolfi rolling | sqlpad | 7.5.7-r29 | — |
| Wolfi rolling | ts-patch | 4.0.1-r41 | — |
| Wolfi rolling | vitess-24 | 24.0.2-r7 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | js-yaml | >= 3.0.0, < 3.15.0 | 3.15.0 | GHSA-52cp-r559-cp3m |
| npm | js-yaml | >= 4.0.0, < 4.3.0 | 4.3.0 | GHSA-52cp-r559-cp3m |
Advisories 15
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHSA-2026:71114 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:71113 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57590 Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:40415 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:38304 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:38236 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:38187 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:37534 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:37577 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:37532 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12070-1 velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026
- WID-SEC-2026-2618 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
References
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
- https://github.com/nodeca/js-yaml/releases/tag/3.15.0
- https://github.com/nodeca/js-yaml/releases/tag/4.3.0