- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/21/2026, js-yaml recorded 2 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of js-yaml and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-84375js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesCVE-2026-73643js-yaml: Exponential parsing time in the flow collections leads to denial of serviceCVE-2026-59868js-yaml: YAML merge-key chains can force quadratic CPU consumptionCVE-2026-59869js-yaml: YAML merge-key chains can force quadratic CPU consumptionCVE-2026-59870js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-84375js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources | Exploitation statusNot exploited | FixYes | Published09/01/2026 | SeverityHigh |
CVE-2026-73643js-yaml: Exponential parsing time in the flow collections leads to denial of service | Exploitation statusActively exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-59868js-yaml: YAML merge-key chains can force quadratic CPU consumption | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityMedium |
CVE-2026-59869js-yaml: YAML merge-key chains can force quadratic CPU consumption | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityHigh |
CVE-2026-59870js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityHigh |
CVE-2026-53550js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityMedium |
CVE-2025-64718js-yaml has prototype pollution in merge (<<) | Exploitation statusNot exploited | FixYes | Published11/13/2025 | SeverityMedium |
CVE-2013-4660CVE-2013-4660 | Exploitation statusNot confirmed | FixNo | Published06/28/2013 | SeverityUnknown |
8 Results | Page 1 of 1