7053 matches found
GHSA-G796-FGMG-93MV js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...
02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21451 more potentially affected by CVE-2026-59869 via js-yaml (>=3.0.0, <=3.14.2)
js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-59869 Source advisory: OSV:GHSA-52CP-R559-CP3M...
02.aula (1.0.0), 0xrtest (1.0.0) +10472 more potentially affected by CVE-2026-59869 via js-yaml (>=4.0.0, <=4.2.0)
js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-59869 Source advisory: GHSA-52CP-R559-CP3M...
02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21451 more potentially affected by CVE-2026-59869 via js-yaml (>=3.0.0, <=3.14.2)
js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-59869 Source advisory: GHSA-52CP-R559-CP3M...
02.aula (1.0.0), 0xrtest (1.0.0) +10472 more potentially affected by CVE-2026-59869 via js-yaml (>=4.0.0, <=4.2.0)
js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-59869 Source advisory: OSV:GHSA-52CP-R559-CP3M...
@adobe/aem-cli (>=16.21.1, <=16.21.2), @adobe/helix-docx2md (>=1.9.29, <=1.9.30) +49 more potentially affected by CVE-2026-59870 via js-yaml (>=5.0.0, <=5.2.0)
js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.0.8, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260824173136 and more Source cves: CVE-2026-59870 Source advisory: OSV:GHSA-724G-MXRG-4QVM...
GHSA-3JXR-9VMJ-R5CP brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Summary brace-expansion's expand exhibits exponential-time - O2ⁿ - behavior in the number of consecutive non-expanding groups. A short, all-ASCII input 90 bytes/30 groups blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consume...
nodejs: Node.js: Certification validation bypass in TLS host verification
A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...
Malicious code in @dxcl/user-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @dxcl/transaction-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10878 Malicious code in @dxcl/transaction-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @dxcl/log-function-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10877 Malicious code in @dxcl/log-function-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @dxcl/http-common-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @dxcl/fund-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10874 Malicious code in @dxcl/fund-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10873 Malicious code in @dxcl/customer-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @dxcl/account-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10872 Malicious code in @dxcl/account-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious Package
Overview @vite-js/vui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...