nodeca js-yaml
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84375 | >= 3.0.0, < 3.15.2 ; >= 4.0.0, < 4.3.2 ; >= 5.0.0, < 5.4.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources | HIGH 7.5 | 0.5 % | ||
| CVE-2026-73643 | >= 5.0.0, < 5.2.2 | js-yaml: Exponential parsing time in the flow collections leads to denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2026-59868 | >= 5.0.0, < 5.2.0 | js-yaml: YAML merge-key chains can force quadratic CPU consumption | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59869 | >= 3.0.0, < 3.15.0 ; >= 4.0.0, < 4.3.0 | js-yaml: YAML merge-key chains can force quadratic CPU consumption | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59870 | >= 5.0.0, < 5.2.1 ; >= 3.0.0, < 3.15.1 ; >= 4.0.0, < 4.3.1 | js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing | HIGH 7.5 | 0.7 % | ||
| CVE-2026-53550 | >= 4.0.0, < 4.2.0 ; < 3.15.0 | js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-64718 | >= 4.0.0, < 4.1.1 ; < 3.14.2 | js-yaml has prototype pollution in merge (<<) | MEDIUM 5.3 | 0.4 % |