CyberRota Analysis
AI-GeneratedThe js-yaml library, used for parsing and dumping YAML in JavaScript, is vulnerable to a denial-of-service attack due to inefficient parsing of documents with specific merge key patterns, leading to excessive CPU consumption. This vulnerability affects versions prior to 3.15.0 and 4.3.0, and organizations utilizing these versions should prioritize updating to the patched releases to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)