js-yaml vulnerabilities

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Affected

>=5.0.0 <5.4.1

Fixed in

5.4.1

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Affected

>=4.0.0 <4.3.2 · >=3.0.0 <3.15.2

Fixed in

3.15.2, 4.3.2

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Affected

>=4.0.0 <4.3.1 · >=3.0.0 <3.15.1

Fixed in

3.15.1, 4.3.1

js-yaml: Exponential parsing time in flow collections leads to denial of service

Affected

>=5.0.0 <5.2.2

Fixed in

5.2.2

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Affected

>=5.0.0 <5.2.0

Fixed in

5.2.0

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Affected

>=3.0.0 <3.15.0 · >=4.0.0 <4.3.0

Fixed in

3.15.0, 4.3.0

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Affected

>=5.0.0 <5.2.1

Fixed in

5.2.1

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Affected

>=4.0.0 <4.2.0 · <3.15.0

Fixed in

3.15.0, 4.2.0

js-yaml has prototype pollution in merge (<<)

Affected

>=4.0.0 <4.1.1 · <3.14.2

Fixed in

3.14.2, 4.1.1

Denial of Service in js-yaml

Affected

<3.13.0

Fixed in

3.13.0

Code Injection in js-yaml

Affected

<3.13.1

Fixed in

3.13.1

Deserialization Code Execution in js-yaml

Affected

<2.0.5

Fixed in

2.0.5