GHSA-2pr6-76vf-7546

GHSA-2pr6-76vf-7546 · Denial of Service in js-yaml

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service. ## Recommendation Upgrade to version 3.13.0.

CVSS 5.9 · Medium · Fix available

Published: 2019-06-05T14:35:29Z
Updated: 2021-08-04T21:32:56Z

Stack: node

Affected products and versions

js-yaml npm
Affected ranges
- SEMVER: < 3.13.0
Update to 3.13.0

Original sources

https://github.com/nodeca/js-yaml/issues/475
https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235
https://snyk.io/vuln/SNYK-JS-JSYAML-173999
https://www.npmjs.com/advisories/788
https://www.npmjs.com/advisories/788/versions
https://osv.dev/vulnerability/GHSA-2pr6-76vf-7546

Check your server →

GHSA-2pr6-76vf-7546 · Denial of Service in js-yaml

Affected products and versions

js-yaml npm

Original sources