Product by Nodeca
Nodeca JS-YAML
8 known vulnerabilities in Nodeca JS-YAML (Nodeca), 0 of them actively exploited (CISA KEV).
Key figures
8
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-59870 | js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing | 7.5 | |
| High | CVE-2026-84375 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources | 7.5 | |
| High | CVE-2026-59868 | js-yaml: YAML merge-key chains can force quadratic CPU consumption | 7.5 | |
| High | CVE-2026-59869 | js-yaml: YAML merge-key chains can force quadratic CPU consumption | 7.5 | |
| Not rated | CVE-2013-4660 | Nodeca JS-YAML: Code Execution | — | |
| High | CVE-2026-73643 | js-yaml: Exponential parsing time in the flow collections leads to denial of service | 7.5 | |
| Medium | CVE-2026-53550 | js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases | 5.3 | |
| Medium | CVE-2025-64718 | js-yaml has prototype pollution in merge (<<) | 5.3 |