Hi,

The following vulnerability was published for node-js-yaml.

CVE-2026-84375[0]:
| js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until
| 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and
| lib/loader.js does not count empty mapping sources while processing
| the merge key <<. An attacker can alias a large sequence of empty
| mappings into many merge targets, causing O(N * K) processing while
| totalMergeKeys remains unchanged and the configured resource limit
| is never reached. A relatively small YAML document can therefore
| cause prolonged CPU consumption in applications that parse untrusted
| YAML, and merge processing is enabled by default on these release
| lines. This issue is fixed in versions 3.15.2 and 4.3.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-84375
https://www.cve.org/CVERecord?id=CVE-2026-84375
[1] https://github.com/nodeca/js-yaml/pull/797
[2] https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1146637 in node-js-yaml reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-js-yaml/-/commit/58edf73468032bb6cd360c1041074674e9716585

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1146637

Hello,

Bug #1146637 in node-js-yaml reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-js-yaml/-/commit/58edf73468032bb6cd360c1041074674e9716585

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1146637

We believe that the bug you reported is fixed in the latest version of
node-js-yaml, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146637@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-js-yaml package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 04 Sep 2026 11:49:45 +0200
Source: node-js-yaml
Architecture: source
Version: 4.3.2+~4.0.9-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1146637
Changes:
 node-js-yaml (4.3.2+~4.0.9-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1146637, CVE-2026-84375)
   * Drop CVE-2026-59869.patch: included
   * Build ES5 with @rollup/plugin-buble
Checksums-Sha1:
 be65551052b8f90dc74b6385b1264b64b842a1cc 2607 node-js-yaml_4.3.2+~4.0.9-1.dsc
 cd82382c4f902fed9691a2ed79ec68c5898af4c2 3632 node-js-yaml_4.3.2+~4.0.9.orig-types-js-yaml.tar.gz
 1567a65d19de82eed23001bed500dfcf29535603 1009589 node-js-yaml_4.3.2+~4.0.9.orig.tar.gz
 d9dc30ad91f2f626b7b34398ccaf1c38646162fa 83328 node-js-yaml_4.3.2+~4.0.9-1.debian.tar.xz
Checksums-Sha256:
 9f9d9d27a2e06710c3f94d38e0ca656536276b30b0468f3e2edeb217b1cd4370 2607 node-js-yaml_4.3.2+~4.0.9-1.dsc
 8c9a234188f42e35d0a4f9256c8ff2972b3215558c05b42fe96b8ac85d6094fd 3632 node-js-yaml_4.3.2+~4.0.9.orig-types-js-yaml.tar.gz
 92f1e0420ec505e5565821d5728fc3fcec91c795609758a26c16942821b1cd00 1009589 node-js-yaml_4.3.2+~4.0.9.orig.tar.gz
 9e970aa824fe2e242a82c09601503cc0511b9725977b72c0a15c0cd562692d97 83328 node-js-yaml_4.3.2+~4.0.9-1.debian.tar.xz
Files:
 da491091a73e535bd7abbfe63a342068 2607 javascript optional node-js-yaml_4.3.2+~4.0.9-1.dsc
 611e298d20865ccb5101e244867bd077 3632 javascript optional node-js-yaml_4.3.2+~4.0.9.orig-types-js-yaml.tar.gz
 a51dfc997da1611eb371de9344579fc6 1009589 javascript optional node-js-yaml_4.3.2+~4.0.9.orig.tar.gz
 8017bf6fe7710e3f2bb927a2b510eca3 83328 javascript optional node-js-yaml_4.3.2+~4.0.9-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqalIgACgkQ9tdMp8mZ
7ukaKg/+MZWfvCodLvV6swA/Y5BcaYDP/zRLNHSEWn8ylQka/g4tK8BRkIu4i2fe
pCEbeeJtvyk4Gc9Zq2d+aBdg7gVLHiwm3vdDsMIUGNdfBD62+1oYfy1/XopiJcm6
h6+051JLaWXLmVXlZsQN8FPXaabKQ7D6W5jI9UNCnDigyR0PpVWy5aFfyg8WABb1
gRUJY06UW+WU2XOsSw1F9uo6ywVe6vO4PC6FxTpxmPRfXyBJMwzNizBZ9DKNSCDz
4q8w+8qtmW7gB1IebKs86z9L8d1yZT8h2MGS/0rPIvu727ZVEFp6padGJ9pzQc/O
mPCfjpUNMAwD95ak5MOpaRUdnuSspkQfDwBAUIM8aVIOBqJXAFP0yOEFwV5xt4Qu
jA4MmGCmtb6qF4vNwWI7e/DRzNeP5lNdNV4iXo5na+uQEP0NUbFKcGeXtMTN9d96
eG6Bx16AP0SGTn21g5xC+J2/9Efwl27OG/K0RqtCTGrLb9Kwakawwa19f7mENueD
4NxOePDc8ZX7PchLoHgmhUvI//BgY6pJvgheTI3p6zxICz640F+cH2TadY5wViun
dBHstcq0G5xAm3I6hkQD4cQXmh87Y1w2B0dp9ALclD7+f9obWxsYkKQHOWxAu1CA
woi6uhUYReslk/JiFACnJmCA8DR2lbHwJHGRFTxwQ+3Voby8XAQ=
=NKXS
-----END PGP SIGNATURE-----