nodeca/js-yaml Security Advisories | GitStock

medium2026-09-29

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

GHSA-r3ph-w7gj-g6xm

high2026-09-08

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

GHSA-2883-xcg3-v3hh · CVE-2026-84375

high2026-08-06

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

GHSA-5p4m-2wfm-xmqj

high2026-07-24

js-yaml: Exponential parsing time in flow collections leads to denial of service

GHSA-pm4m-ph32-ghv5 · CVE-2026-73643

medium2026-07-20

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

GHSA-g796-fgmg-93mv · CVE-2026-59868

high2026-07-20

js-yaml: YAML merge-key chains can force quadratic CPU consumption

GHSA-52cp-r559-cp3m · CVE-2026-59869

medium2026-07-20

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

GHSA-724g-mxrg-4qvm · CVE-2026-59870

medium2026-06-15

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

GHSA-h67p-54hq-rp68 · CVE-2026-53550

medium2025-11-14

js-yaml has prototype pollution in merge (<<)

GHSA-mh29-5h37-fv8m · CVE-2025-64718