{"id":"CVE-2026-59870","aliases":["CLSA-2026-1787592038","CLSA-2026-1790944389","CLSA-2026-1790950175","CLSA-2026-1790950271","CLSA-2026-1792473143","CLSA-2026-1792755810","EUVD-2026-42300","GHSA-724g-mxrg-4qvm","RHSA-2026:26994","RHSA-2026:33866","RHSA-2026:34478","RHSA-2026:34975","RHSA-2026:35272","RHSA-2026:7378","RHSA-2026:7655","RHSA-2026:9455","UBUNTU-CVE-2026-59870"],"status":"published","title":"js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0074,"percentile":0.55079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407","CWE-770"],"published":"2026-04-21T10:09:52Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"npm","package":"js-yaml","fixed_in":["5.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"js-yaml","fixed_in":["3.15.0-tuxcare.1","3.7.0-tuxcare.4","4.3.0-tuxcare.4","3.14.1-tuxcare.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.2.0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.0-tuxcare.0"},{"fixed":"3.15.0-tuxcare.1"}]}],"versions":["3.15.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0-tuxcare.0"},{"fixed":"3.7.0-tuxcare.4"}]}],"versions":["3.7.0","3.7.0-tuxcare.1","3.7.0-tuxcare.2","3.7.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-tuxcare.0"},{"fixed":"4.3.0-tuxcare.4"}]}],"versions":["4.3.0","4.3.0-tuxcare.1","4.3.0-tuxcare.2","4.3.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-tuxcare.0"},{"fixed":"4.1.0-tuxcare.4"}]}],"versions":["4.1.0","4.1.0-tuxcare.1","4.1.0-tuxcare.2","4.1.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0-tuxcare.0"},{"fixed":"5.2.0-tuxcare.1"}]}],"versions":["5.2.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.1-tuxcare.0"},{"fixed":"3.14.1-tuxcare.4"}]}],"versions":["3.14.1","3.14.1-tuxcare.1","3.14.1-tuxcare.2","3.14.1-tuxcare.3"]},{"source":"osv","ecosystem":"npm","package":"js-yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.17.0-1.26.4.0.1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs26-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.4.0-1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-14.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.6.202.34-1.26.4.0.1.3.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.16.0-1.24.18.0.0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs24-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.18.0-0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.6.233.17-1.24.18.0.0.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-none-softfloat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-aarch64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-i686-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-pc-windows-gnu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-none","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rust-std-static-x86_64-unknown-uefi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.96.1-1.hum1"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.9.8-1.22.23.1.2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs22-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.23.1-2.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.12.1-1.25.9.0.1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.22-18.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.8.2-1.20.20.2.1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.1+dfsg-1","3.10.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.13.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.1+dfsg+~3.12.6-2","4.1.0+dfsg+~4.0.5-4ubuntu1","4.1.0+dfsg+~4.0.5-5","4.1.0+dfsg+~4.0.5-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+dfsg+~4.0.9-1","4.2.0+~4.0.9-1","4.2.0+~4.0.9-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-js-yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg+~4.0.5-7","4.1.1+dfsg+~4.0.9-1"]}],"products":[{"vendor":"nodeca","product":"js-yaml"}],"references":[{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["x_refsource_MISC","Release Notes","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-724g-mxrg-4qvm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59870.json","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26994","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45591","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45491","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59724","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26994.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45491","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45591","tags":["advisory"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59724","tags":["advisory"]},{"url":"https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c","tags":["article"]},{"url":"https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7","tags":["article"]},{"url":"https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53550","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48934","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48930","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48619","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48935","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33866.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","tags":["article"]},{"url":"https://www.npmjs.com/package/brace-expansion","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48619","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48930","tags":["advisory"]},{"url":"https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e","tags":["article"]},{"url":"https://hackerone.com/reports/3656716","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48934","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48935","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48936","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491401","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34478","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34478.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34975","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-38969","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12064","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8286","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11586","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8927","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8925","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11564","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9080","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11856","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14683","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14685","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14686","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8932","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9547","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14684","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15187","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34975.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8286.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8286.json","tags":["article"]},{"url":"https://hackerone.com/reports/3718195","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8458.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8458.json","tags":["article"]},{"url":"https://hackerone.com/reports/3721183","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8924.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8924.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733905","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8925","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8925.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8925.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735193","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496760","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8926","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8926.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8926.json","tags":["article"]},{"url":"https://hackerone.com/reports/3735184","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8927.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8927.json","tags":["article"]},{"url":"https://hackerone.com/reports/3744543","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-8932.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-8932.json","tags":["article"]},{"url":"https://hackerone.com/reports/3733910","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9079","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9079.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9079.json","tags":["article"]},{"url":"https://hackerone.com/reports/3750295","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9080","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9080.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9080.json","tags":["article"]},{"url":"https://hackerone.com/reports/3749204","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9546","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9546.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9546.json","tags":["article"]},{"url":"https://hackerone.com/reports/3754343","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496758","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9547","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9547.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9547.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751712","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496757","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11352","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11352.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11352.json","tags":["article"]},{"url":"https://hackerone.com/reports/3783438","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11564","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11564.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11564.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788984","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496753","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11586","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11586.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11586.json","tags":["article"]},{"url":"https://hackerone.com/reports/3788931","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-11856.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-11856.json","tags":["article"]},{"url":"https://hackerone.com/reports/3793260","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12064","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-12064.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-12064.json","tags":["article"]},{"url":"https://hackerone.com/reports/3797526","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497102","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14683","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/","tags":["article"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/219","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14683","tags":["article"]},{"url":"https://vuldb.com/submit/846750","tags":["article"]},{"url":"https://vuldb.com/submit/846752","tags":["article"]},{"url":"https://vuldb.com/vuln/376279","tags":["article"]},{"url":"https://vuldb.com/vuln/376279/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14684","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/220","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14684","tags":["article"]},{"url":"https://vuldb.com/submit/846754","tags":["article"]},{"url":"https://vuldb.com/vuln/376280","tags":["article"]},{"url":"https://vuldb.com/vuln/376280/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14685","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/221","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14685","tags":["article"]},{"url":"https://vuldb.com/submit/846761","tags":["article"]},{"url":"https://vuldb.com/vuln/376281","tags":["article"]},{"url":"https://vuldb.com/vuln/376281/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14686","tags":["advisory"]},{"url":"https://github.com/HdrHistogram/HdrHistogram/issues/222","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-14686","tags":["article"]},{"url":"https://vuldb.com/submit/846762","tags":["article"]},{"url":"https://vuldb.com/vuln/376282","tags":["article"]},{"url":"https://vuldb.com/vuln/376282/cti","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15187","tags":["advisory"]},{"url":"https://github.com/enquirer/enquirer/","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487","tags":["article"]},{"url":"https://github.com/enquirer/enquirer/issues/487#issuecomment-4648521328","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-15187","tags":["article"]},{"url":"https://vuldb.com/submit/851357","tags":["article"]},{"url":"https://vuldb.com/vuln/377113","tags":["article"]},{"url":"https://vuldb.com/vuln/377113/cti","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-38969","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35272","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35272.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7378","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59464","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55132","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55131","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2950","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6734","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9675","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9678","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48618","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48615","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7378.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431350","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59464","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2950","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6734","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9675","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48615","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48618","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48933","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7655.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9455","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8723","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9455.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-59870","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59870","title":"js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.","status":"published","published":"2026-07-08T15:13:20.308Z","modified":"2026-10-06T15:07:05.157Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-42300","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.","status":"published","published":"2026-07-08T15:13:20Z","modified":"2026-10-06T15:07:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:37.480805Z"}],"ghsa":[{"id":"GHSA-724g-mxrg-4qvm","title":"js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA","description":"### Summary\n`js-yaml` v5.x introduces `YAML11_SCHEMA` support with the `!!omap` (ordered map) tag. The `omapTag.addItem()` function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses `yaml.load()` with `{ schema: yaml.YAML11_SCHEMA }`.\n\n### Details\nIn `src/tag/sequence/omap.ts` (compiled: `dist/js-yaml.cjs.js:510-525`):\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () =\u003e [],\n    addItem: (container, item) =\u003e {\n        // ...\n        for (const existing of container)   // O(n) per insertion!\n            if (hasOwnProperty(existing, itemKeys[0]))\n                return 'cannot resolve an ordered map item';\n        container.push(object);             // n insertions → O(n^2) total\n        return '';\n    }\n});\n```\nFor a document with `n` unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = **O(n²)** total work.\n\n### PoC (runtime-confirmed on v5.2.0)\n```js\nconst yaml = require('js-yaml');\nfunction buildOmapPayload(n) {\n  let p = '!!omap\\n';\n  for (let i = 0; i \u003c n; i++) p += '- key' + i + ': val' + i + '\\n';\n  return p;\n}\n// Timing results on v5.2.0:\n// n=1000:  9ms\n// n=5000:  73ms  (5x n → 8x time)\n// n=10000: 255ms (2x n → 3.5x time — supralinear)\n// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)\n// n=50000: 10613ms          ← blocks event loop for \u003e10 seconds\nyaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });\n```\n\n### Impact\nAny application that parses untrusted YAML using `yaml.load(input, { schema: yaml.YAML11_SCHEMA })` is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).\n\nThis affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including `!!omap`. The 4.x series is unaffected (no `YAML11_SCHEMA` export).\n\n### Fix\nReplace the O(n) linear scan in `addItem` with an O(1) `Set`-based lookup:\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () =\u003e ({ list: [], seen: new Set() }),\n    addItem: (state, item) =\u003e {\n        const key = Object.keys(item)[0];\n        if (state.seen.has(key)) return 'duplicate omap key';\n        state.seen.add(key);\n        state.list.push(item);\n        return '';\n    },\n    resolve: (state) =\u003e state.list\n});\n```","status":"published","published":"2026-07-20T21:18:51Z","modified":"2026-07-20T21:18:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T14:40:47.245721Z"}],"nvd":[{"id":"CVE-2026-59870","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.","status":"published","published":"2026-07-08T16:16:33.58Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-59870","title":"js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.","status":"published","published":"2026-07-08T15:13:20.308Z","modified":"2026-10-28T02:30:44.702847017Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-724g-mxrg-4qvm","title":"js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA","description":"### Summary\n`js-yaml` v5.x introduces `YAML11_SCHEMA` support with the `!!omap` (ordered map) tag. The `omapTag.addItem()` function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses `yaml.load()` with `{ schema: yaml.YAML11_SCHEMA }`.\n\n### Details\nIn `src/tag/sequence/omap.ts` (compiled: `dist/js-yaml.cjs.js:510-525`):\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () =\u003e [],\n    addItem: (container, item) =\u003e {\n        // ...\n        for (const existing of container)   // O(n) per insertion!\n            if (hasOwnProperty(existing, itemKeys[0]))\n                return 'cannot resolve an ordered map item';\n        container.push(object);             // n insertions → O(n^2) total\n        return '';\n    }\n});\n```\nFor a document with `n` unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = **O(n²)** total work.\n\n### PoC (runtime-confirmed on v5.2.0)\n```js\nconst yaml = require('js-yaml');\nfunction buildOmapPayload(n) {\n  let p = '!!omap\\n';\n  for (let i = 0; i \u003c n; i++) p += '- key' + i + ': val' + i + '\\n';\n  return p;\n}\n// Timing results on v5.2.0:\n// n=1000:  9ms\n// n=5000:  73ms  (5x n → 8x time)\n// n=10000: 255ms (2x n → 3.5x time — supralinear)\n// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)\n// n=50000: 10613ms          ← blocks event loop for \u003e10 seconds\nyaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });\n```\n\n### Impact\nAny application that parses untrusted YAML using `yaml.load(input, { schema: yaml.YAML11_SCHEMA })` is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).\n\nThis affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including `!!omap`. The 4.x series is unaffected (no `YAML11_SCHEMA` export).\n\n### Fix\nReplace the O(n) linear scan in `addItem` with an O(1) `Set`-based lookup:\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () =\u003e ({ list: [], seen: new Set() }),\n    addItem: (state, item) =\u003e {\n        const key = Object.keys(item)[0];\n        if (state.seen.has(key)) return 'duplicate omap key';\n        state.seen.add(key);\n        state.list.push(item);\n        return '';\n    },\n    resolve: (state) =\u003e state.list\n});\n```","status":"published","published":"2026-07-20T21:18:51Z","modified":"2026-09-10T03:50:51.442129612Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-407","CWE-770"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"RHSA-2026:26994","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:10:03Z","modified":"2026-10-20T10:06:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:33866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-01T10:19:52Z","modified":"2026-10-20T10:07:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34478","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-02T10:17:47Z","modified":"2026-10-20T10:07:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:34975","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:07:59Z","modified":"2026-10-17T10:12:31Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:35272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-04T10:08:01Z","modified":"2026-10-20T10:07:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:7378","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:52Z","modified":"2026-10-20T10:15:20Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:32Z","modified":"2026-10-20T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:9455","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:51Z","modified":"2026-10-19T10:08:10Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2026-59870","description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.","status":"published","published":"2026-07-08T16:16:00Z","modified":"2026-10-17T13:00:28.502170865Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1787592038","title":"TuxCare security update for js-yaml (1 CVE)","description":"TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.0-tuxcare.1.","status":"published","published":"2026-08-24T17:20:38Z","modified":"2026-10-15T09:46:45.700215352Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790944389","title":"TuxCare security update for js-yaml (1 CVE)","description":"TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.4.","status":"published","published":"2026-10-02T12:33:09Z","modified":"2026-10-15T09:47:38.81632789Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1790950175","title":"TuxCare security update for js-yaml (1 CVE)","description":"TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.3.0-tuxcare.4.","status":"published","published":"2026-10-02T14:09:35Z","modified":"2026-10-15T09:47:57.922309124Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1790950271","title":"TuxCare security update for js-yaml (2 CVEs)","description":"TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 4.1.0-tuxcare.4.","status":"published","published":"2026-10-02T14:11:11Z","modified":"2026-10-15T09:47:38.691147421Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792473143","title":"TuxCare security update for js-yaml (2 CVEs)","description":"TuxCare rebuilt js-yaml to address 2 CVEs. Fixed in 5.2.0-tuxcare.1.","status":"published","published":"2026-10-20T05:12:23Z","modified":"2026-10-20T07:15:05.868798216Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792755810","title":"TuxCare security update for js-yaml (1 CVE)","description":"TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.1-tuxcare.4.","status":"published","published":"2026-10-23T11:43:30Z","modified":"2026-10-23T13:45:35.082155604Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}