Skip to content
Threat Feed
Subscribe

Product

Js-Yaml (>= 3.0.0, < 3.15.2)

1 brief RSS
low advisory

Denial of Service Vulnerability in js-yaml via Empty Merge Source Exhaustion

The js-yaml library fails to correctly account for empty mappings when enforcing maxTotalMergeKeys, allowing attackers to trigger excessive CPU consumption through specially crafted YAML documents.

js-yaml +1 vulnerability denial-of-service supply-chain
1c