What’s Vulnerable › Products

nodeca js-yaml vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your nodeca js-yaml version is affected

Latest nodeca js-yaml vulnerabilities

• CVE-2026-84375 — js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources (CVSS 7.5)
• CVE-2026-73643 — js-yaml: Exponential parsing time in the flow collections leads to denial of service (CVSS 7.5)
• CVE-2026-59870 — js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing (CVSS 7.5)
• CVE-2026-59869 — js-yaml: YAML merge-key chains can force quadratic CPU consumption (CVSS 7.5)
• CVE-2026-59868 — js-yaml: YAML merge-key chains can force quadratic CPU consumption (CVSS 7.5)
• CVE-2026-53550 — js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases (CVSS 5.3)
• CVE-2025-64718 — js-yaml has prototype pollution in merge (<<) (CVSS 5.3)
• CVE-2013-4660 — (CVSS 6.8)