Source: node-js-yaml Version: 4.2.0+~4.0.9-2 Severity: important Tags: security upstream Forwarded: https://github.com/nodeca/js-yaml/pull/797 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for node-js-yaml. CVE-2026-84375[0]: | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until | 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and | lib/loader.js does not count empty mapping sources while processing | the merge key <<. An attacker can alias a large sequence of empty | mappings into many merge targets, causing O(N * K) processing while | totalMergeKeys remains unchanged and the configured resource limit | is never reached. A relatively small YAML document can therefore | cause prolonged CPU consumption in applications that parse untrusted | YAML, and merge processing is enabled by default on these release | lines. This issue is fixed in versions 3.15.2 and 4.3.2. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84375 https://www.cve.org/CVERecord?id=CVE-2026-84375 [1] https://github.com/nodeca/js-yaml/pull/797 [2] https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
