What is GHSA-2pr6-76vf-7546?

GHSA-2pr6-76vf-7546 is a security advisory published by GitHub Security Advisories with Medium severity. Denial of Service in js-yaml

Why does GHSA-2pr6-76vf-7546 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-2pr6-76vf-7546?

GHSA-2pr6-76vf-7546 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-2pr6-76vf-7546?

GHSA-2pr6-76vf-7546 affects 1 product, including: npm/js-yaml:\u003c 3.13.0.

GHSA-2pr6-76vf-7546MediumCVSS 5.9Disclosed before NVD

Denial of Service in js-yaml

Vendor

GitHub Security Advisories

Published

June 5, 2019

Last Modified

January 9, 2023

📋 Description

Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Recommendation

Upgrade to version 3.13.0.

🎯 Affected products1

npm/js-yaml:< 3.13.0

🔗 References (6)

https://github.com/nodeca/js-yaml/issues/475
https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235
https://www.npmjs.com/advisories/788
https://www.npmjs.com/advisories/788/versions
https://snyk.io/vuln/SNYK-JS-JSYAML-173999
https://github.com/advisories/GHSA-2pr6-76vf-7546