nodejs-js-yaml security update
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fix(es): js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.(CVE-2026-84375)
OESA-2026-4060
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OESA-2026-4060
nodejs-js-yaml
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.10.0-3.oe2403sp4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
nodejs-js-yaml
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.10.0-3.oe2003sp4
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
nodejs-js-yaml
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.10.0-3.oe2203sp4
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
nodejs-js-yaml
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.10.0-3.oe2403sp1
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
nodejs-js-yaml
Source reference: /affected/4/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.10.0-3.oe2403sp3
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-3.oe2403sp4"
}
]
}
],
"package": {
"name": "nodejs-js-yaml",
"purl": "pkg:rpm/openEuler/nodejs-js-yaml&distro=openEuler-24.03-LTS-SP4",
"ecosystem": "openEuler:24.03-LTS-SP4"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4060.json"
},
"ecosystem_specific": {
"src": [
"nodejs-js-yaml-3.10.0-3.oe2403sp4.src.rpm"
],
"noarch": [
"nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch.rpm"
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-3.oe2003sp4"
}
]
}
],
"package": {
"name": "nodejs-js-yaml",
"purl": "pkg:rpm/openEuler/nodejs-js-yaml&distro=openEuler-20.03-LTS-SP4",
"ecosystem": "openEuler:20.03-LTS-SP4"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4060.json"
},
"ecosystem_specific": {
"src": [
"nodejs-js-yaml-3.10.0-3.oe2003sp4.src.rpm"
],
"noarch": [
"nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch.rpm"
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-3.oe2203sp4"
}
]
}
],
"package": {
"name": "nodejs-js-yaml",
"purl": "pkg:rpm/openEuler/nodejs-js-yaml&distro=openEuler-22.03-LTS-SP4",
"ecosystem": "openEuler:22.03-LTS-SP4"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4060.json"
},
"ecosystem_specific": {
"src": [
"nodejs-js-yaml-3.10.0-3.oe2203sp4.src.rpm"
],
"noarch": [
"nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch.rpm"
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-3.oe2403sp1"
}
]
}
],
"package": {
"name": "nodejs-js-yaml",
"purl": "pkg:rpm/openEuler/nodejs-js-yaml&distro=openEuler-24.03-LTS-SP1",
"ecosystem": "openEuler:24.03-LTS-SP1"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4060.json"
},
"ecosystem_specific": {
"src": [
"nodejs-js-yaml-3.10.0-3.oe2403sp1.src.rpm"
],
"noarch": [
"nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch.rpm"
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-3.oe2403sp3"
}
]
}
],
"package": {
"name": "nodejs-js-yaml",
"purl": "pkg:rpm/openEuler/nodejs-js-yaml&distro=openEuler-24.03-LTS-SP3",
"ecosystem": "openEuler:24.03-LTS-SP3"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4060.json"
},
"ecosystem_specific": {
"src": [
"nodejs-js-yaml-3.10.0-3.oe2403sp3.src.rpm"
],
"noarch": [
"nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch.rpm"
]
}
}
]Publisher severity
high
Source reference: /database_specific/severity
- Event
- #14707 · Revision 1
- Added to Heist Feed
- Publisher date