Denial of Service in js-yaml

概要

参考情報

• nodeca/js-yaml · WEB
• nodeca/js-yaml commit a567ef3 · WEB
• snyk.io/vuln/SNYK-JS-JSYAML-173999 · WEB
• npmjs.com/advisories/788 · WEB
• npmjs.com/advisories/788/versions · WEB

js-yaml のその他の脆弱性

• GHSA-r3ph-w7gj-g6xm中 5.3js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
• CVE-2026-84375高 7.5js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and li…
• CVE-2026-73643高 7.5js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an appl…
• GHSA-5p4m-2wfm-xmqj高 7.5JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
• CVE-2026-59870高 7.5js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/seque…