js-yaml has 3 CVEs on record. 1 was published in the last 90 days. The median CVSS is 7.5 (high). The most common weakness class is CWE-407 (3).
CVEs per month
Last 12 months, by publish date
1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 2
3
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
GHSA-5p4m-2wfm-xmqjHigh· 7.5JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported41GHSA-pm4m-ph32-ghv5High· 7.5js-yaml: Exponential parsing time in flow collections leads to denial of service41GHSA-r3ph-w7gj-g6xmMedium· 5.3js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources29
js-yaml vulnerabilities
CVEs affecting js-yaml, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
GHSA-r3ph-w7gj-g6xmMedium· 5.3js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
▾ Sunlitjs-yaml · js-yamlvia GHSA
GHSA-5p4m-2wfm-xmqjHigh· 7.5JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
▾ Twilightjs-yaml · js-yamlvia GHSA
GHSA-pm4m-ph32-ghv5High· 7.5js-yaml: Exponential parsing time in flow collections leads to denial of service
js-yaml: Exponential parsing time in flow collections leads to denial of service
▾ Twilightjs-yaml · js-yamlvia GHSA