VulnSea

nodeca has 6 CVEs on record between 2025 and 2026. 2 were published in the last 90 days. The busiest recent month was July 2026 with 3. The median CVSS is 7.5 (high). None have a confirmed exploitation report. The most common weakness class is CWE-407 (4). Most affected products: js-yaml (5), probe-image-size (1).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
2 prev 3

Products

  • js-yaml 5
  • probe-image-size 1
Follow nodeca:RSS feedSave a search →Embed badge ↗
6
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

nodeca vulnerabilities

CVEs affecting nodeca, newest first. Open any entry for full detail, references, and exploit status.

6 CVEsRSS

CVE-2026-104861High· 7.5PoC
4w ago

probe-image-size gets image dimensions without downloading the entire file

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the en…

▾ Midnightnodeca · probe-image-sizeEPSS 0.43%via NVD
CVE-2026-84375High· 7.5
1mo ago

js-yaml is a JavaScript YAML parser and dumper

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker c…

▾ Twilightnodeca · js-yamlEPSS 0.54%via NVD
CVE-2026-59870High· 7.5PoC⚖ disputed
3mo ago

js-yaml is a JavaScript YAML parser and dumper

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, cau…

▾ Midnightnodeca · js-yamlEPSS 0.74%via NVD
CVE-2026-59869High· 7.5
3mo ago

js-yaml is a JavaScript YAML parser and dumper

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where e…

▾ Twilightnodeca · js-yamlEPSS 0.58%via NVD
CVE-2026-59868Medium· 5.3⚖ disputed
3mo ago

js-yaml is a JavaScript YAML parser and dumper

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where e…

▾ Sunlitnodeca · js-yamlEPSS 0.64%via NVD
CVE-2025-64718Medium· 5.3
11mo ago

js-yaml is a JavaScript YAML parser and dumper

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse …

▾ Sunlitnodeca · js-yamlEPSS 0.42%via NVD
nodeca vulnerabilities (CVEs) · VulnSea