TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
Vulnerabilities
6 records
TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm
js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-38621 CVE-2026-53550 · GHSA-h67p-54hq-rp68
js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Priority LOW 30
js-yaml is a JavaScript YAML parser and dumper.
TI-2025-40064 CVE-2025-64718 · GHSA-mh29-5h37-fv8m
js-yaml has prototype pollution in merge (<<)
Priority LOW 30
js-yaml is a JavaScript YAML parser and dumper.
TI-2013-04085 CVE-2013-4660 · GHSA-xxvw-45rp-3mj2
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the…
Priority MEDIUM 47
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval opera…