Vulnerable Library - devkit-0.21.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (devkit version) |
Remediation Possible** |
| CVE-2026-84370 |
 High |
8.2 |
svgo-4.0.0.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-73650 |
High |
8.2 |
svgo-4.0.0.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-29074 |
High |
7.5 |
svgo-4.0.0.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-84369 |
 Medium |
6.1 |
svgo-4.0.0.tgz |
Transitive |
N/A* |
❌ |
| CVE-2026-85062 |
Medium |
5.3 |
colord-2.9.3.tgz |
Transitive |
0.22.0 |
❌ |
| CVE-2026-33532 |
Medium |
4.3 |
yaml-2.8.1.tgz |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-84370
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- devkit-0.21.0.tgz (Root Library)
- unbuild-0.56.14.tgz
- mkdist-2.4.1.tgz
- cssnano-7.1.1.tgz
- cssnano-preset-default-7.0.9.tgz
- postcss-svgo-7.1.0.tgz
- ❌ svgo-4.0.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Publish Date: 2026-09-01
URL: CVE-2026-84370
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-w27v-7q3p-w38r
Release Date: 2026-09-01
Fix Resolution: svgo - 4.1.0,svgo - 3.3.5,svgo - 2.8.4,https://github.com/svg/svgo.git - v3.3.5,https://github.com/svg/svgo.git - v2.8.4,https://github.com/svg/svgo.git - v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-73650
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- devkit-0.21.0.tgz (Root Library)
- unbuild-0.56.14.tgz
- mkdist-2.4.1.tgz
- cssnano-7.1.1.tgz
- cssnano-preset-default-7.0.9.tgz
- postcss-svgo-7.1.0.tgz
- ❌ svgo-4.0.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as "svg:script" (svg:script) and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-13
URL: CVE-2026-73650
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution: https://github.com/svg/svgo.git - v3.3.4,https://github.com/svg/svgo.git - v4.0.2
Step up your Open Source Security Game with Mend here
CVE-2026-29074
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- devkit-0.21.0.tgz (Root Library)
- unbuild-0.56.14.tgz
- mkdist-2.4.1.tgz
- cssnano-7.1.1.tgz
- cssnano-preset-default-7.0.9.tgz
- postcss-svgo-7.1.0.tgz
- ❌ svgo-4.0.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Publish Date: 2026-03-06
URL: CVE-2026-29074
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xpqw-6gx7-v673
Release Date: 2026-03-05
Fix Resolution: svgo - 3.3.3,svgo - 4.0.1,svgo - 2.8.1
Step up your Open Source Security Game with Mend here
CVE-2026-84369
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- devkit-0.21.0.tgz (Root Library)
- unbuild-0.56.14.tgz
- mkdist-2.4.1.tgz
- cssnano-7.1.1.tgz
- cssnano-preset-default-7.0.9.tgz
- postcss-svgo-7.1.0.tgz
- ❌ svgo-4.0.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Publish Date: 2026-09-01
URL: CVE-2026-84369
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4vpr-x523-8j87
Release Date: 2026-09-01
Fix Resolution: svgo - 2.8.4,svgo - 4.1.0,svgo - 3.3.5,https://github.com/svg/svgo.git - v3.3.5,https://github.com/svg/svgo.git - v2.8.4,https://github.com/svg/svgo.git - v4.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-85062
Vulnerable Library - colord-2.9.3.tgz
? A tiny yet powerful tool for high-performance color manipulations and conversions
Library home page: https://registry.npmjs.org/colord/-/colord-2.9.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- devkit-0.21.0.tgz (Root Library)
- unbuild-0.56.14.tgz
- mkdist-2.4.1.tgz
- cssnano-7.1.1.tgz
- cssnano-preset-default-7.0.9.tgz
- postcss-colormin-7.0.4.tgz
- ❌ colord-2.9.3.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
Publish Date: 2026-09-03
URL: CVE-2026-85062
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-09-03
Fix Resolution (colord): 2.9.4
Direct dependency fix Resolution (@storm-stack/devkit): 0.22.0
Step up your Open Source Security Game with Mend here
CVE-2026-33532
Vulnerable Library - yaml-2.8.1.tgz
JavaScript parser and stringifier for YAML
Library home page: https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- devkit-0.21.0.tgz (Root Library)
- markdown-0.20.0.tgz
- ❌ yaml-2.8.1.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
"yaml" is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of "yaml" on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a "RangeError: Maximum call stack size exceeded" with a small payload (~2–10 KB). The "RangeError" is not a "YAMLParseError", so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one "[" and one "]"). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's "Parser" (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: "YAML.parse()", "YAML.parseDocument()", and "YAML.parseAllDocuments()". Versions 1.10.3 and 2.8.3 contain a patch.
Publish Date: 2026-03-26
URL: CVE-2026-33532
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/eemeli/yaml.git - v1.10.3,https://github.com/eemeli/yaml.git - v2.8.3
Step up your Open Source Security Game with Mend here
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Publish Date: 2026-09-01
URL: CVE-2026-84370
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-w27v-7q3p-w38r
Release Date: 2026-09-01
Fix Resolution: svgo - 4.1.0,svgo - 3.3.5,svgo - 2.8.4,https://github.com/svg/svgo.git - v3.3.5,https://github.com/svg/svgo.git - v2.8.4,https://github.com/svg/svgo.git - v4.1.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as "svg:script" (svg:script) and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-13
URL: CVE-2026-73650
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-13
Fix Resolution: https://github.com/svg/svgo.git - v3.3.4,https://github.com/svg/svgo.git - v4.0.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.
Publish Date: 2026-03-06
URL: CVE-2026-29074
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xpqw-6gx7-v673
Release Date: 2026-03-05
Fix Resolution: svgo - 3.3.3,svgo - 4.0.1,svgo - 2.8.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - svgo-4.0.0.tgz
SVGO is a Node.js library and command-line application for optimizing vector images.
Library home page: https://registry.npmjs.org/svgo/-/svgo-4.0.0.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.
Publish Date: 2026-09-01
URL: CVE-2026-84369
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4vpr-x523-8j87
Release Date: 2026-09-01
Fix Resolution: svgo - 2.8.4,svgo - 4.1.0,svgo - 3.3.5,https://github.com/svg/svgo.git - v3.3.5,https://github.com/svg/svgo.git - v2.8.4,https://github.com/svg/svgo.git - v4.1.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - colord-2.9.3.tgz
? A tiny yet powerful tool for high-performance color manipulations and conversions
Library home page: https://registry.npmjs.org/colord/-/colord-2.9.3.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
Publish Date: 2026-09-03
URL: CVE-2026-85062
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-09-03
Fix Resolution (colord): 2.9.4
Direct dependency fix Resolution (@storm-stack/devkit): 0.22.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - yaml-2.8.1.tgz
JavaScript parser and stringifier for YAML
Library home page: https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz
Sample Path to Dependency File: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
"yaml" is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of "yaml" on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a "RangeError: Maximum call stack size exceeded" with a small payload (~2–10 KB). The "RangeError" is not a "YAMLParseError", so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one "[" and one "]"). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's "Parser" (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: "YAML.parse()", "YAML.parseDocument()", and "YAML.parseAllDocuments()". Versions 1.10.3 and 2.8.3 contain a patch.
Publish Date: 2026-03-26
URL: CVE-2026-33532
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-25
Fix Resolution: https://github.com/eemeli/yaml.git - v1.10.3,https://github.com/eemeli/yaml.git - v2.8.3
Step up your Open Source Security Game with Mend here