CVE-2026-73643Published
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-73643 · Microsoft / collected KEV context
cve-program · CVE-2026-73643
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5
- https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853
nvd · CVE-2026-73643
- https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5
osv · GHSA-pm4m-ph32-ghv5
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.