GHSA-h67p-54hq-rp68
Medium · 5.3CVSS
5.3
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | js-yaml | 0 | 4.2.0 |
Related vulnerabilities
- CVE-2026-53550 js-yaml is a JavaScript YAML parser and dumper. Same vulnerability
- GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) Also affects js-yaml
- CVE-2025-64718 js-yaml is a JavaScript YAML parser and dumper. Also affects js-yaml
- GHSA-2pr6-76vf-7546 Denial of Service in js-yaml Also affects js-yaml
- GHSA-8j8c-7jfh-h6hx Code Injection in js-yaml Also affects js-yaml
- CVE-2013-4660 The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the… Also affects js-yaml
- CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure will result… CWE-407
- CVE-2026-112894 Pillow is a Python imaging library. CWE-407