nodeca js-yaml
7 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84375 | >= 3.0.0, < 3.15.2 ; >= 4.0.0, < 4.3.2 ; >= 5.0.0, < 5.4.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources | HIGH 7.5 | 0.5 % | ||
| CVE-2026-73643 | >= 5.0.0, < 5.2.2 | js-yaml: Exponential parsing time in the flow collections leads to denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2026-59868 | >= 5.0.0, < 5.2.0 | js-yaml: YAML merge-key chains can force quadratic CPU consumption | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59869 | >= 3.0.0, < 3.15.0 ; >= 4.0.0, < 4.3.0 | js-yaml: YAML merge-key chains can force quadratic CPU consumption | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59870 | >= 5.0.0, < 5.2.1 ; >= 3.0.0, < 3.15.1 ; >= 4.0.0, < 4.3.1 | js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing | HIGH 7.5 | 0.7 % | ||
| CVE-2026-53550 | >= 4.0.0, < 4.2.0 ; < 3.15.0 | js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-64718 | >= 4.0.0, < 4.1.1 ; < 3.14.2 | js-yaml has prototype pollution in merge (<<) | MEDIUM 5.3 | 0.4 % |