An update for nodejs-js-yaml is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2026-4060
Final
1.0
1.0
2026-09-25
Initial
2026-09-25
2026-09-25
openEuler SA Tool V1.0
2026-09-25
nodejs-js-yaml security update
An update for nodejs-js-yaml is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3
This is an implementation of YAML (YAML Ain't Markup Language), a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec.
Security Fix(es):
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.(CVE-2026-84375)
An update for nodejs-js-yaml is now available for openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
nodejs-js-yaml
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4060
https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-84375
https://nvd.nist.gov/vuln/detail/CVE-2026-84375
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
nodejs-js-yaml-3.10.0-3.oe2403sp4.noarch.rpm
nodejs-js-yaml-3.10.0-3.oe2003sp4.noarch.rpm
nodejs-js-yaml-3.10.0-3.oe2203sp4.noarch.rpm
nodejs-js-yaml-3.10.0-3.oe2403sp1.noarch.rpm
nodejs-js-yaml-3.10.0-3.oe2403sp3.noarch.rpm
nodejs-js-yaml-3.10.0-3.oe2403sp4.src.rpm
nodejs-js-yaml-3.10.0-3.oe2003sp4.src.rpm
nodejs-js-yaml-3.10.0-3.oe2203sp4.src.rpm
nodejs-js-yaml-3.10.0-3.oe2403sp1.src.rpm
nodejs-js-yaml-3.10.0-3.oe2403sp3.src.rpm
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.
2026-09-25
CVE-2026-84375
openEuler-24.03-LTS-SP4
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP3
High
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nodejs-js-yaml security update
2026-09-25
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4060