JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Summary A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relative...

Inefficient Algorithmic Complexity

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the storeMappingPair function in loader.js when handling repeated aliases in merge sequences. An attacker can exhaust CPU resources and...

02.aula (1.0.0), 0xrtest (1.0.0) +10372 more potentially affected by CVE-2026-53550 via js-yaml (>=4.0.0, <=4.1.1)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-53550 Source advisory: OSV:GHSA-H67P-54HQ-RP68...

02.aula (1.0.0), 0xrtest (1.0.0) +10372 more potentially affected by CVE-2026-53550 via js-yaml (>=4.0.0, <=4.1.1)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-53550 Source advisory: SNYK:JS-JSYAML-17342520...

02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21451 more potentially affected by CVE-2026-53550 via js-yaml (>=3.0.0, <=3.14.2)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-53550 Source advisory: OSV:GHSA-H67P-54HQ-RP68...

GHSA-H67P-54HQ-RP68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Summary A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relative...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50168 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-17357205...

EUVD-2026-36721

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7...

Information Exposure

Axios is vulnerable to Information Exposure. The vulnerability is due to improper handling of the Proxy-Authorization header in the Node.js HTTP adapter, where proxy credentials can be forwarded to a redirected destination during certain proxy-to-direct redirect flows, allowing an...

jsonata: Function Binding Prototype Pollution via hasOwnProperty Override

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible ...

CVE-2026-12208

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible ...

CVE-2026-48886: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

PT-2026-49551

Name of the Vulnerable Software and Affected Versions UAParser.js versions 2.0.1 through 2.0.9 Description A regular expression denial-of-service ReDoS exists when using the Client Hints API. An attacker can cause excessive CPU consumption and a denial-of-service condition in server-side...

CVE-2026-12208: Improperly Controlled Modification of Object Prototype Attributes

A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible ...

CVE-2026-48887: Missing Authorization

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

PT-2026-49573

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.2.0 Description A crafted YAML document can trigger algorithmic CPU exhaustion during merge-key processing by repeating the same alias multiple times in a merge sequence. This results in quadratic parse-time behavio...

Malicious Package

Overview xnder-sdk-js is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

Malicious code in chalk-plus-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5351482f03a50cab8a28b6aa7c992c960a55c6889634d2a04bb86a157ac18d1 Package is published under a name riding the popular chalk color-output library but its source tree, README, main entry lib/nodemailer.js, and lib...

PT-2026-48997

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting issue exists in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping within a single-quoted...

Malicious Package

Overview solana-js-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...