TI-2026-66141 CVE-2026-104861 · GHSA-gjj5-9665-rwrc
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Priority HIGH 72
probe-image-size gets image dimensions without downloading the entire file.
Vulnerabilities
9 records
TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Priority MEDIUM 40
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-51727 CVE-2026-73643 · GHSA-pm4m-ph32-ghv5
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm
js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-38621 CVE-2026-53550 · GHSA-h67p-54hq-rp68
js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Priority LOW 30
js-yaml is a JavaScript YAML parser and dumper.
TI-2025-40064 CVE-2025-64718 · GHSA-mh29-5h37-fv8m
js-yaml has prototype pollution in merge (<<)
Priority LOW 30
js-yaml is a JavaScript YAML parser and dumper.
TI-2013-04085 CVE-2013-4660 · GHSA-xxvw-45rp-3mj2
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the…
Priority MEDIUM 47
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval opera…