Denial of Service in js-yaml

GHSA-2pr6-76vf-7546

Published Jun 5, 2019 · Modified Aug 4, 2021

Description

Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Recommendation

Upgrade to version 3.13.0.

References

WEB https://github.com/nodeca/js-yaml/issues/475
WEB https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235
WEB https://snyk.io/vuln/SNYK-JS-JSYAML-173999
WEB https://www.npmjs.com/advisories/788
WEB https://www.npmjs.com/advisories/788/versions

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes