Known vulnerabilities in js-yaml (npm)

Vendor: npm Inc.
Software: js-yaml (npm)
Software CPE: cpe:2.3:a:npm:js-yaml:*:*:*:*:*:*:*:*
Total vulnerabilities: 9
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting js-yaml (npm) js-yaml (npm) is affected by 9 known vulnerabilities: 9 medium Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140667 - Inefficient Algorithmic Complexity
CWE-407 Medium
No
No
3.15.1, 4.3.1 01.08.2026 SB2026080109
#VU140666 - Inefficient Algorithmic Complexity
CVE-2026-73643
CWE-407 Medium
No
No
5.2.2 01.08.2026 SB2026080108
#VU136867 - Resource exhaustion
CVE-2026-59869
CWE-400 Medium
No
No
3.15.0, 4.3.0 03.07.2026 SB2026070344
SB20260731138
#VU136866 - Resource exhaustion
CVE-2026-59868
CWE-400 Medium
No
No
5.2.0 03.07.2026 SB2026070346
#VU136865 - Resource exhaustion
CVE-2026-59870
CWE-400 Medium
No
No
5.2.1 03.07.2026 SB2026070345
#VU136864 - Inefficient Algorithmic Complexity
CVE-2026-53550
CWE-407 Medium
No
No
3.15.0, 4.2.0 03.07.2026 SB2026070344
#VU121666 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2025-64718
CWE-1321 Medium
No
No
4.1.1 19.01.2026 SB2026011995
SB2026011999
SB20260119100
and 25 more
#VU18053 - Resource exhaustion
CWE-400 Medium
No
No
3.13.0 21.03.2019 SB2019032106
#VU42769 - Improper input validation
CVE-2013-4660
CWE-20 Medium
Available
No
- 28.06.2013 SB2013062801