GHSA-xxvw-45rp-3mj2 critical
Deserialization Code Execution in js-yaml
Affected range
SEMVER: introduced 0; fixed 2.0.5Fixed versions: 2.0.5
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
5.4.1
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
11 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-pm4m-ph32-ghv5 high
js-yaml: Exponential parsing time in flow collections leads to denial of service
Affected range
SEMVER: introduced 5.0.0; fixed 5.2.2Fixed versions: 5.2.2
GHSA-5p4m-2wfm-xmqj high
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Affected range
SEMVER: introduced 4.0.0; fixed 4.3.1SEMVER: introduced 3.0.0; fixed 3.15.1Fixed versions: 4.3.1, 3.15.1
GHSA-52cp-r559-cp3m high
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Affected range
SEMVER: introduced 3.0.0; fixed 3.15.0SEMVER: introduced 4.0.0; fixed 4.3.0Fixed versions: 3.15.0, 4.3.0
GHSA-2883-xcg3-v3hh high
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Affected range
SEMVER: introduced 4.0.0; fixed 4.3.2SEMVER: introduced 3.0.0; fixed 3.15.2Fixed versions: 4.3.2, 3.15.2
GHSA-8j8c-7jfh-h6hx high
Code Injection in js-yaml
Affected range
SEMVER: introduced 0; fixed 3.13.1Fixed versions: 3.13.1
GHSA-mh29-5h37-fv8m moderate
js-yaml has prototype pollution in merge (<<)
Affected range
SEMVER: introduced 4.0.0; fixed 4.1.1SEMVER: introduced 0; fixed 3.14.2Fixed versions: 4.1.1, 3.14.2
GHSA-724g-mxrg-4qvm moderate
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
Affected range
SEMVER: introduced 5.0.0; fixed 5.2.1Fixed versions: 5.2.1
GHSA-h67p-54hq-rp68 moderate
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Affected range
SEMVER: introduced 4.0.0; fixed 4.2.0SEMVER: introduced 0; fixed 3.15.0Fixed versions: 4.2.0, 3.15.0
GHSA-g796-fgmg-93mv moderate
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
Affected range
SEMVER: introduced 5.0.0; fixed 5.2.0Fixed versions: 5.2.0
GHSA-2pr6-76vf-7546 moderate
Denial of Service in js-yaml
Affected range
SEMVER: introduced 0; fixed 3.13.0Fixed versions: 3.13.0