Packages / js-yaml / Security

ModerateVulnerabilityGHSA-2pr6-76vf-7546Published 5 Jun 2019

Denial of Service in js-yaml

Your version

Affected releases · js-yaml

  • 3.x3.0.0 – 3.12.2Fixed in 3.13.0
  • 2.x and older0.2.0 – 2.1.3No fix, no longer updated

On 3.x, the newest line:

npm install js-yaml@3.13.0
Every release on a timeline
5.x

  1. Not affected

    5.0.0 – 5.5.0

    12 releases, latest

3.x

  1. Affected

    3.0.0 – 3.12.2

    42 releases

  2. Fixed

    3.13.0 – 3.15.2

    8 releases

2.x

  1. Affected

    2.0.0 – 2.1.3

    10 releases

1.x

  1. Affected

    1.0.0 – 1.0.3

    4 releases

0.x

  1. Affected

    0.2.0 – 0.3.7

    11 releases

94 stable releases of js-yaml, oldest to newest, one row per major.

What happens

Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Recommendation

Upgrade to version 3.13.0.