TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm
js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:33866
Red Hat Hardened Images RPMs Security Update
Released 2026-06-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images nodejs26-1:26.4.0-1.3.hum1@aarch64, nodejs26-1:26.4.0-1.3.hum1@src, nodejs26-1:26.4.0-1.3.hum1@x86_64 +16
Fixes 10 records
TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-36189 CVE-2026-48930 · GHSA-g779-8rvr-37xx
Improper access control in NodeJS node
Priority MEDIUM 42
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.
TI-2026-35965 CVE-2026-48619 · GHSA-v3cq-r2f8-qmmc
Uncontrolled resource consumption in NodeJS node
Priority MEDIUM 40
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
TI-2026-38621 CVE-2026-53550 · GHSA-h67p-54hq-rp68
js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Priority LOW 30
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-36187 CVE-2026-48928 · GHSA-3h92-9jcv-8677
Improper access control in NodeJS node
Priority LOW 24
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
TI-2026-36193 CVE-2026-48934 · GHSA-px9q-xv67-75fr
Improper certificate validation in NodeJS node
Priority LOW 20
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
TI-2026-36195 CVE-2026-48936 · GHSA-hwhp-f859-r728
Improper access control in NodeJS node
Priority LOW 15
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.
TI-2026-36194 CVE-2026-48935 · GHSA-9qm6-cjgc-f64v
Incorrect default permissions in NodeJS node
Priority LOW 15
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.