org.webjars.npm:js-yaml 3.15.2

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:js-yaml package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (`<<`) handling of the loader, where the `maxTotalMergeKeys` budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(NK) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments. Note:* This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.webjars.npm:js-yaml` to version 4.3.2 or higher.	[,4.3.2)
H Inefficient Algorithmic Complexity org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `readFlowCollection` function of `parser.ts`, which reaches exponential time when a flow sequence entry turns out to be a `key: value` pair and the parser rewinds to parse that entry a second time as the key. An attacker can exhaust CPU and block the Node event loop by supplying a small YAML document, under 200 bytes, with deeply nested flow sequences of `key: value` entries, since the re-parsing makes the work grow as O(2^n) in nesting depth. Exploitation occurs under the default configuration when the application parses untrusted YAML with `load()` or `loadAll()`, and needs no special schema, anchors, aliases, or merge keys. How to fix Inefficient Algorithmic Complexity? A fix was pushed into the `master` branch but not yet published.	[0,)
H Inefficient Algorithmic Complexity org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (`<<`) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved. How to fix Inefficient Algorithmic Complexity? Upgrade `org.webjars.npm:js-yaml` to version 4.3.1 or higher.	[,4.3.1)
M Prototype Pollution org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Prototype Pollution via the `merge` function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing `__proto__` properties. This can lead to unexpected behavior or security issues in applications that process untrusted YAML input. How to fix Prototype Pollution? Upgrade `org.webjars.npm:js-yaml` to version 4.1.1 or higher.	[,4.1.1)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

org.webjars.npm:js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (<<) handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments.

Note: This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.webjars.npm:js-yaml to version 4.3.2 or higher.

[,4.3.2)

Inefficient Algorithmic Complexity

org.webjars.npm:js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and the parser rewinds to parse that entry a second time as the key. An attacker can exhaust CPU and block the Node event loop by supplying a small YAML document, under 200 bytes, with deeply nested flow sequences of key: value entries, since the re-parsing makes the work grow as O(2^n) in nesting depth. Exploitation occurs under the default configuration when the application parses untrusted YAML with load() or loadAll(), and needs no special schema, anchors, aliases, or merge keys.

How to fix Inefficient Algorithmic Complexity?

A fix was pushed into the master branch but not yet published.

[0,)

Inefficient Algorithmic Complexity

org.webjars.npm:js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (<<) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved.

How to fix Inefficient Algorithmic Complexity?

Upgrade org.webjars.npm:js-yaml to version 4.3.1 or higher.

[,4.3.1)

Prototype Pollution

org.webjars.npm:js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Prototype Pollution via the merge function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing __proto__ properties. This can lead to unexpected behavior or security issues in applications that process untrusted YAML input.

How to fix Prototype Pollution?

Upgrade org.webjars.npm:js-yaml to version 4.1.1 or higher.

[,4.1.1)

org.webjars.npm:js-yaml@3.15.2

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically