Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
js-yaml versions before 3.13.0 can crash your server
published 7 years ago
Summary
Older versions of js-yaml can be tricked into freezing your server, causing it to become unresponsive and potentially run out of resources. This can happen when a specially designed YAML file is parsed. To prevent this, update to the latest version of js-yaml, 3.13.0 or later.
What to do
- Update vitaly js-yaml to version 3.13.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | vitaly | js-yaml |
< 3.13.0 Fix: upgrade to 3.13.0
|
Original advisory text
Denial of Service in js-yaml
Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
## Recommendation
Upgrade to version 3.13.0.
## Recommendation
Upgrade to version 3.13.0.
References
- https://github.com/nodeca/js-yaml/issues/475
- https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb0123...
- https://www.npmjs.com/advisories/788
- https://www.npmjs.com/advisories/788/versions
- https://snyk.io/vuln/SNYK-JS-JSYAML-173999
- https://github.com/advisories/GHSA-2pr6-76vf-7546
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published5 Jun 2019
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-2pr6-76vf-7546 · GHSA
Track software like this
Free during beta