nodeca js-yaml

• CVE-2026-84375 High 7.5 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 0.5%
• CVE-2026-73643 High 7.5 js-yaml: Exponential parsing time in the flow collections leads to denial of service 0.5%
• CVE-2026-59868 Medium 5.3 js-yaml: YAML merge-key chains can force quadratic CPU consumption 0.6%
• CVE-2026-59869 High 7.5 js-yaml: YAML merge-key chains can force quadratic CPU consumption 0.6%
• CVE-2026-59870 High 7.5 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing 0.7%
• CVE-2026-53550 Medium 5.3 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 0.4%
• CVE-2025-64718 Medium 5.3 js-yaml has prototype pollution in merge (<<) 0.4%