npm - OSV

GHSA-r3ph-w7gj-g6xm

npm/js-yaml

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 6 days ago

Fix available
Severity - 5.3 (Medium)

GHSA-2883-xcg3-v3hh

npm/js-yaml

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 08 Sep

Fix available
Severity - 7.5 (High)

GHSA-5p4m-2wfm-xmqj

npm/js-yaml

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 06 Aug

Fix available
Severity - 7.5 (High)

GHSA-pm4m-ph32-ghv5

npm/js-yaml

js-yaml: Exponential parsing time in flow collections leads to denial of service 24 Jul

Fix available
Severity - 7.5 (High)

GHSA-g796-fgmg-93mv

npm/js-yaml

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml 20 Jul

Fix available
Severity - 5.3 (Medium)

GHSA-52cp-r559-cp3m

npm/js-yaml

js-yaml: YAML merge-key chains can force quadratic CPU consumption 20 Jul

Fix available
Severity - 7.5 (High)

GHSA-724g-mxrg-4qvm

npm/js-yaml

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA 20 Jul

Fix available
Severity - 5.3 (Medium)

GHSA-h67p-54hq-rp68

npm/js-yaml

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 15 Jun

Fix available
Severity - 5.3 (Medium)

MAL-2026-5193

npm/javascript-yaml

Malicious code in javascript-yaml (npm) 04 Jun

No fix available

MAL-2026-5194

npm/yaml-javascript

Malicious code in yaml-javascript (npm) 04 Jun

No fix available

GHSA-48c2-rrv3-qjmp

npm/yaml

yaml is vulnerable to Stack Overflow via deeply nested YAML collections 25 Mar

Fix available
Severity - 4.3 (Medium)

MAL-2026-1242

npm/yaml-manifest-utils-mynarratorai

Malicious code in yaml-manifest-utils-mynarratorai (npm) 04 Mar

No fix available

GHSA-mh29-5h37-fv8m

npm/js-yaml

js-yaml has prototype pollution in merge (<<) 14 Nov 2025

Fix available
Severity - 5.3 (Medium)

MAL-2025-185539

npm/archaeometry-yaml-phoebe-ophiuchus

Malicious code in archaeometry-yaml-phoebe-ophiuchus (npm) 13 Nov 2025

No fix available

MAL-2025-185741

npm/bad-xml-simple-yaml-reject

Malicious code in bad-xml-simple-yaml-reject (npm) 13 Nov 2025

No fix available

MAL-2025-186002

npm/capella-yaml-innercore-hermes

Malicious code in capella-yaml-innercore-hermes (npm) 13 Nov 2025

No fix available

Vulnerabilities