{"id":"CVE-2026-59868","aliases":["CLSA-2026-1784596307","CLSA-2026-1790944177","EUVD-2026-42302","GHSA-g796-fgmg-93mv","RHSA-2026:26994","RHSA-2026:33866","RHSA-2026:34478","RHSA-2026:34975","RHSA-2026:35272","RHSA-2026:7378","RHSA-2026:7655","RHSA-2026:9455","UBUNTU-CVE-2026-59868"],"status":"published","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00644,"percentile":0.51377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407","CWE-770"],"published":"2026-04-21T10:09:52Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"js-yaml","fixed_in":["5.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"js-yaml","fixed_in":["3.7.0-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.1.0"},{"fixed":"5.2.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0-tuxcare.0"},{"fixed":"3.7.0-tuxcare.2"}]}],"versions":["3.7.0","3.7.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0-tuxcare.0"},{"fixed":"4.2.0-tuxcare.2"}]}],"versions":["4.2.0","4.2.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.2.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.4.0.1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.4.0.1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.0.0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.18.0.0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.8-1.22.23.1.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.12.1-1.25.9.0.1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.22-18.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.8.2-1.20.20.2.1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.1+dfsg-1","3.10.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.1+dfsg+~3.12.6-2","4.1.0+dfsg+~4.0.5-4ubuntu1","4.1.0+dfsg+~4.0.5-5","4.1.0+dfsg+~4.0.5-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+dfsg+~4.0.9-1","4.2.0+~4.0.9-1","4.2.0+~4.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7","4.1.1+dfsg+~4.0.9-1"]}],"products":[{"vendor":"nodeca","product":"js-yaml"}],"references":[{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["x_refsource_MISC","Release Notes","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g796-fgmg-93mv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59868.json","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26994","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45591","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45491","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59724","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26994.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45491","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45591","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59724","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c","tags":["article"]},{"url":"https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7","tags":["article"]},{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53550","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48934","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48930","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48619","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48935","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48619","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48930","tags":["advisory"]},{"url":"https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e","tags":["article"]},{"url":"https://hackerone.com/reports/3656716","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48934","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48935","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48936","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34478","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34478.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-38969","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12064","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8286","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8925","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9080","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14683","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14685","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14686","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14684","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15187","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34975.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8286.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8286.json","tags":["article"]},{"url":"https://hackerone.com/reports/3718195","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8458.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8458.json","tags":["article"]},{"url":"https://hackerone.com/reports/3721183","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733905","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8925.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8925.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735193","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496760","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8926.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8926.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735184","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["article"]},{"url":"https://hackerone.com/reports/3744543","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8932.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8932.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733910","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9079.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9079.json","tags":["article"]},{"url":"https://hackerone.com/reports/3750295","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9080.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9080.json","tags":["article"]},{"url":"https://hackerone.com/reports/3749204","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9546.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9546.json","tags":["article"]},{"url":"https://hackerone.com/reports/3754343","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9547.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9547.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751712","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11352","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11352.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11352.json","tags":["article"]},{"url":"https://hackerone.com/reports/3783438","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11564","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11564.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11564.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788984","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11586.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11586.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788931","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["article"]},{"url":"https://hackerone.com/reports/3793260","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-12064.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-12064.json","tags":["article"]},{"url":"https://hackerone.com/reports/3797526","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14683","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/","tags":["article"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/219","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14683","tags":["article"]},{"url":"https://vuldb.com/submit/846750","tags":["article"]},{"url":"https://vuldb.com/submit/846752","tags":["article"]},{"url":"https://vuldb.com/vuln/376279","tags":["article"]},{"url":"https://vuldb.com/vuln/376279/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14684","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/220","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14684","tags":["article"]},{"url":"https://vuldb.com/submit/846754","tags":["article"]},{"url":"https://vuldb.com/vuln/376280","tags":["article"]},{"url":"https://vuldb.com/vuln/376280/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14685","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/221","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14685","tags":["article"]},{"url":"https://vuldb.com/submit/846761","tags":["article"]},{"url":"https://vuldb.com/vuln/376281","tags":["article"]},{"url":"https://vuldb.com/vuln/376281/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14686","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/222","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14686","tags":["article"]},{"url":"https://vuldb.com/submit/846762","tags":["article"]},{"url":"https://vuldb.com/vuln/376282","tags":["article"]},{"url":"https://vuldb.com/vuln/376282/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15187","tags":["advisory"]},{"url":"https://github.com/enquirer/enquirer/","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487#issuecomment-4648521328","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-15187","tags":["article"]},{"url":"https://vuldb.com/submit/851357","tags":["article"]},{"url":"https://vuldb.com/vuln/377113","tags":["article"]},{"url":"https://vuldb.com/vuln/377113/cti","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-38969","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35272","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35272.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7378","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59464","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55132","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55131","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6734","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9675","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9678","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48618","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48615","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7378.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431350","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59464","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6734","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9675","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48615","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48618","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48933","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7655.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9455","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8723","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9455.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-59868","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59868","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","status":"published","published":"2026-07-08T15:18:19.422Z","modified":"2026-07-09T13:42:54.035Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-42302","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","status":"published","published":"2026-07-08T15:18:19Z","modified":"2026-07-09T13:42:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:04.523855Z"}],"ghsa":[{"id":"GHSA-g796-fgmg-93mv","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml","description":"### Impact\n\nThis is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default\n\nWhen merge keys (`\u003c\u003c`) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:\n\n```yaml\na0: \u0026a0 { k0: 0 }\na1: \u0026a1 { \u003c\u003c: *a0, k1: 1 }\na2: \u0026a2 { \u003c\u003c: *a1, k2: 2 }\na3: \u0026a3 { \u003c\u003c: *a2, k3: 3 }\n...\nb: *aN\n```\n\nFor each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.\n\n### PoC\n\nFrom N = 4000 delay become \u003e 1s (doc size \u003c 100K)\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { Buffer } from 'node:buffer'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = Number(process.argv[2] || 4000)\n\nfunction makeMergeChain (count) {\n  const lines = ['a0: \u0026a0 { k0: 0 }']\n\n  for (let i = 1; i \u003c count; i++) {\n    lines.push(`a${i}: \u0026a${i} { \u003c\u003c: *a${i - 1}, k${i}: ${i} }`)\n  }\n\n  lines.push(`b: *a${count - 1}`)\n  return `${lines.join('\\n')}\\n`\n}\n\nconst source = makeMergeChain(n)\n\nconsole.log(source.split('\\n').slice(0, 8).join('\\n'))\nconsole.log('...')\nconsole.log(source.split('\\n').slice(-4).join('\\n'))\nconsole.log()\nconsole.log(`N: ${n}`)\nconsole.log(`YAML size: ${Buffer.byteLength(source)} bytes`)\n\nconst started = performance.now()\nconst result = load(source, { schema: YAML11_SCHEMA })\nconst elapsed = performance.now() - started\n\nconsole.log(`parse time: ${elapsed.toFixed(1)} ms`)\nconsole.log(`top-level keys: ${Object.keys(result).length}`)\nconsole.log(`b keys: ${Object.keys(result.b).length}`)\n```\n\n### Patches\n\nFix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases.","status":"published","published":"2026-07-20T21:19:27Z","modified":"2026-07-20T21:19:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-407","CWE-770"],"updated_at":"2026-11-02T14:40:47.245721Z"}],"nvd":[{"id":"CVE-2026-59868","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","status":"published","published":"2026-07-08T16:16:33.27Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-59868","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","status":"published","published":"2026-07-08T15:18:19.422Z","modified":"2026-10-28T02:30:45.208894617Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-g796-fgmg-93mv","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml","description":"### Impact\n\nThis is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default\n\nWhen merge keys (`\u003c\u003c`) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:\n\n```yaml\na0: \u0026a0 { k0: 0 }\na1: \u0026a1 { \u003c\u003c: *a0, k1: 1 }\na2: \u0026a2 { \u003c\u003c: *a1, k2: 2 }\na3: \u0026a3 { \u003c\u003c: *a2, k3: 3 }\n...\nb: *aN\n```\n\nFor each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.\n\n### PoC\n\nFrom N = 4000 delay become \u003e 1s (doc size \u003c 100K)\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { Buffer } from 'node:buffer'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = Number(process.argv[2] || 4000)\n\nfunction makeMergeChain (count) {\n  const lines = ['a0: \u0026a0 { k0: 0 }']\n\n  for (let i = 1; i \u003c count; i++) {\n    lines.push(`a${i}: \u0026a${i} { \u003c\u003c: *a${i - 1}, k${i}: ${i} }`)\n  }\n\n  lines.push(`b: *a${count - 1}`)\n  return `${lines.join('\\n')}\\n`\n}\n\nconst source = makeMergeChain(n)\n\nconsole.log(source.split('\\n').slice(0, 8).join('\\n'))\nconsole.log('...')\nconsole.log(source.split('\\n').slice(-4).join('\\n'))\nconsole.log()\nconsole.log(`N: ${n}`)\nconsole.log(`YAML size: ${Buffer.byteLength(source)} bytes`)\n\nconst started = performance.now()\nconst result = load(source, { schema: YAML11_SCHEMA })\nconst elapsed = performance.now() - started\n\nconsole.log(`parse time: ${elapsed.toFixed(1)} ms`)\nconsole.log(`top-level keys: ${Object.keys(result).length}`)\nconsole.log(`b keys: ${Object.keys(result.b).length}`)\n```\n\n### Patches\n\nFix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases.","status":"published","published":"2026-07-20T21:19:27Z","modified":"2026-07-20T21:30:38.305649104Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-407","CWE-770"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"RHSA-2026:26994","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:10:03Z","modified":"2026-10-20T10:06:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:33866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-01T10:19:52Z","modified":"2026-10-20T10:07:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34478","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-02T10:17:47Z","modified":"2026-10-20T10:07:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34975","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:07:59Z","modified":"2026-10-17T10:12:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:35272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:08:01Z","modified":"2026-10-20T10:07:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:7378","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:52Z","modified":"2026-10-20T10:15:20Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:32Z","modified":"2026-10-20T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:9455","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:51Z","modified":"2026-10-19T10:08:10Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2026-59868","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","status":"published","published":"2026-07-08T16:16:00Z","modified":"2026-10-17T13:00:28.858941714Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1784596307","title":"TuxCare security update for js-yaml (1 CVE)","description":"TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:52.635535561Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790944177","title":"TuxCare security update for js-yaml (2 CVEs)","description":"TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.2.0-tuxcare.2.","status":"published","published":"2026-10-02T12:29:37Z","modified":"2026-10-15T09:47:38.565435852Z","updated_at":"2026-11-02T15:43:49.016976Z"}]}}