GHSA-2pr6-76vf-7546 Denial of Service in js-yaml
An attacker can cause a denial of service by providing a crafted YAML file to applications using the vulnerable js-yaml library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2pr6-76vf-7546?
GHSA-2pr6-76vf-7546 is a denial of service vulnerability in js-yaml, published on 5 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Recommendation
Upgrade to version 3.13.0.
Which versions are affected by GHSA-2pr6-76vf-7546?
2 open source packages ship an affected version, including js-yaml.
| Package | Affected | Fixed in |
|---|---|---|
js-yaml npm | All versions | 3.13.0 |
js-yaml npm | All versions | 3.13.0 |
How do I fix GHSA-2pr6-76vf-7546?
Upgrade js-yaml to 3.13.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-2pr6-76vf-7546 being exploited?
There is no known exploitation of GHSA-2pr6-76vf-7546 in the wild and no public exploit code.