Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-59869 →

DEBIAN-CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a d...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 node-js-yaml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-js-yaml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-js-yaml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0+~4.0.9-2"}]}]

Références

advisory security-tracker.debian.org