{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"nodejs-js-yaml security update", "category":"general", "title":"Synopsis" }, { "text":"An update for nodejs-js-yaml is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3", "category":"general", "title":"Summary" }, { "text":"This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.\n\nSecurity Fix(es):\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.(CVE-2026-84375)", "category":"general", "title":"Description" }, { "text":"An update for nodejs-js-yaml is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"nodejs-js-yaml", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-4060", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4060" }, { "summary":"CVE-2026-84375", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-84375&packageName=nodejs-js-yaml" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375" }, { "summary":"openEuler-SA-2026-4060 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4060.json" } ], "title":"An update for nodejs-js-yaml is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3", "tracking":{ "initial_release_date":"2026-09-30T16:01:02+08:00", "revision_history":[ { "date":"2026-09-30T16:01:02+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-09-30T16:01:02+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-09-30T16:01:02+08:00", "id":"openEuler-SA-2026-4060", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"openEuler-24.03-LTS-SP4", "name":"openEuler-24.03-LTS-SP4" }, "name":"openEuler-24.03-LTS-SP4", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4" }, "product_id":"openEuler-20.03-LTS-SP4", "name":"openEuler-20.03-LTS-SP4" }, "name":"openEuler-20.03-LTS-SP4", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"openEuler-22.03-LTS-SP4", "name":"openEuler-22.03-LTS-SP4" }, "name":"openEuler-22.03-LTS-SP4", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"openEuler-24.03-LTS-SP1", "name":"openEuler-24.03-LTS-SP1" }, "name":"openEuler-24.03-LTS-SP1", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"openEuler-24.03-LTS-SP3", "name":"openEuler-24.03-LTS-SP3" }, "name":"openEuler-24.03-LTS-SP3", "category":"product_version" } ], "category":"product_name" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2403sp4.src.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp4.src.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2403sp4.src.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2003sp4.src.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2003sp4.src.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2003sp4.src.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2203sp4.src.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2203sp4.src.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2203sp4.src.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2403sp1.src.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp1.src.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2403sp1.src.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"nodejs-js-yaml-3.10.0-3.oe2403sp3.src.rpm", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp3.src.rpm" }, "name":"nodejs-js-yaml-3.10.0-3.oe2403sp3.src.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP4", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch", "name":"nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch as a component of openEuler-20.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch", "name":"nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP4", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2403sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.src", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp4.src as a component of openEuler-24.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-20.03-LTS-SP4", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2003sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.src", "name":"nodejs-js-yaml-3.10.0-3.oe2003sp4.src as a component of openEuler-20.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2203sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.src", "name":"nodejs-js-yaml-3.10.0-3.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2403sp1.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.src", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"nodejs-js-yaml-3.10.0-3.oe2403sp3.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.src", "name":"nodejs-js-yaml-3.10.0-3.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-84375", "notes":[ { "text":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch", "openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch", "openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch", "openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch", "openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch", "openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.src", "openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.src", "openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.src", "openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.src", "openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch", "openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch", "openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch", "openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch", "openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch", "openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.src", "openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.src", "openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.src", "openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.src", "openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.src" ], "details":"nodejs-js-yaml security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4060" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch", "openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch", "openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch", "openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch", "openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch", "openEuler-24.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2403sp4.src", "openEuler-20.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2003sp4.src", "openEuler-22.03-LTS-SP4:nodejs-js-yaml-3.10.0-3.oe2203sp4.src", "openEuler-24.03-LTS-SP1:nodejs-js-yaml-3.10.0-3.oe2403sp1.src", "openEuler-24.03-LTS-SP3:nodejs-js-yaml-3.10.0-3.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-84375" } ] }