nodeca

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

nodeca records in CISA KEV

No nodeca vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Js-yaml 6 records HIGH

Records

9 records

TI-2026-66141 CVE-2026-104861 · GHSA-gjj5-9665-rwrc

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

HIGH 72

probe-image-size gets image dimensions without downloading the entire file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2026-10-02 Fixed in 7.4.0 CWE-1333

TI-2026-51727 CVE-2026-73643 · GHSA-pm4m-ph32-ghv5

js-yaml: Exponential parsing time in the flow collections leads to denial of service

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-08-13 Partial fix · 5.2.2 CWE-407

TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm

js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-07-08 Partial fix · 5.2.1, 3.15.1 +1 CWE-407

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00644 Published 2026-07-08 Fixed in 5.2.0 CWE-407

TI-2013-04085 CVE-2013-4660 · GHSA-xxvw-45rp-3mj2

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the…

MEDIUM 47

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval opera…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.17186 Published 2013-06-28 Fixed in 2.0.5 CWE-20

TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

MEDIUM 40

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00541 Published 2026-09-01 Partial fix · 3.15.2, 4.3.2 +1 CWE-400

TI-2026-38621 CVE-2026-53550 · GHSA-h67p-54hq-rp68

js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

LOW 30

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00415 Published 2026-06-22 Partial fix · 4.2.0, 3.15.0 CWE-407

TI-2025-40064 CVE-2025-64718 · GHSA-mh29-5h37-fv8m

js-yaml has prototype pollution in merge (<<)

LOW 30

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00423 Published 2025-11-13 Partial fix · 4.1.1, 3.14.2 CWE-1321

Open these records in search →

Critical	0
High	6
Medium	3
Low	0
No CVSS	0