npm/js-yaml

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Modified: 9/8/2026

Denial of Service in js-yaml

Modified: 8/4/2021

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Modified: 9/10/2026

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Modified: 9/10/2026

js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Modified: 9/10/2026

Code Injection in js-yaml

Modified: 8/31/2020

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Modified: 7/20/2026

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Modified: 9/10/2026

js-yaml has prototype pollution in merge (<<)

Modified: 9/10/2026

js-yaml: Exponential parsing time in flow collections leads to denial of service

Modified: 9/10/2026

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Modified: 9/29/2026

Deserialization Code Execution in js-yaml

Modified: 11/8/2023