NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

NPM: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.4.0...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

ROOT-APP-NPM-GHSA-8J8C-7JFH-H6HX GHSA-8j8c-7jfh-h6hx in js-yaml - Patched by Root

Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-5P4M-2WFM-XMQJ GHSA-5p4m-2wfm-xmqj in js-yaml - Patched by Root

Root has patched GHSA-5p4m-2wfm-xmqj in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84375 CVE-2026-84375 in js-yaml - Patched by Root

Root has patched CVE-2026-84375 in the js-yaml package for Root:npm. Multiple fixed versions available...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

CLSA-2026-1790183141 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.3.1-tuxcare.3...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-53550)

Summary A Denial of Service vulnerability in the js-yaml document parsing library CVE-2026-53550 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser...

CLEANSTART-2026-PJ72615 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the qdrant package. js-yaml is a JavaScript YAML parser and dumper...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-59869)

Summary A Prototype Pollution vulnerability in the js-yaml document parsing library CVE-2026-59869 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parse...

Important: Red Hat Security Advisory: Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2

Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

Security Bulletin: Vulnerability in js-yaml affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Privilege Escalation / Denial of Service CVE-2026-64718 threat due to the use of js-yaml. js-yaml is part of Node.js, which is used by TS7700 to provide the Management Interface. Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION:...

CLSA-2026-1788978094 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.0-tuxcare.2...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch6 Vulnerability Details CVEID:CVE-2026-59870 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts use...