nodeca records
6 published records for vendor nodeca.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 1 · 16.7%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-407 Inefficient Algorithmic Complexity4
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')1
- CWE-20 Improper Input Validation1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2013-4660Weaponized | The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attanodeca · js-yaml · CWE-20 | Medium6.8 | — | 17.3% | Jun 28, 2013 |
30Monitor | CVE-2026-59870No exploit | js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingnodeca · js-yaml · CWE-407 | High7.5 | — | 0.7% | Jul 8, 2026 |
30Monitor | CVE-2026-59868No exploit | js-yaml: YAML merge-key chains can force quadratic CPU consumptionnodeca · js-yaml · CWE-407 | High7.5 | — | 0.6% | Jul 8, 2026 |
30Monitor | CVE-2026-59869No exploit | js-yaml: YAML merge-key chains can force quadratic CPU consumptionnodeca · js-yaml · CWE-407 | High7.5 | — | 0.5% | Jul 8, 2026 |
21Monitor | CVE-2025-64718No exploit | js-yaml has prototype pollution in merge (<<)nodeca · js-yaml · CWE-1321 | Medium5.3 | — | 0.4% | Nov 13, 2025 |
21Monitor | CVE-2026-53550No exploit | js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesnodeca · js-yaml · CWE-407 | Medium5.3 | — | 0.4% | Jun 22, 2026 |
- CVE-2013-466040Plan
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote atta
MediumCVSS 6.8WeaponizedEPSS 17%nodeca · js-yamlJun 28, 2013
- CVE-2026-5987030Monitor
js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
HighCVSS 7.5No exploitEPSS 0%nodeca · js-yamlJul 8, 2026
- CVE-2026-5986830Monitor
js-yaml: YAML merge-key chains can force quadratic CPU consumption
HighCVSS 7.5No exploitEPSS 0%nodeca · js-yamlJul 8, 2026
- CVE-2026-5986930Monitor
js-yaml: YAML merge-key chains can force quadratic CPU consumption
HighCVSS 7.5No exploitEPSS 0%nodeca · js-yamlJul 8, 2026
- CVE-2025-6471821Monitor
js-yaml has prototype pollution in merge (<<)
MediumCVSS 5.3No exploitEPSS 0%nodeca · js-yamlNov 13, 2025
- CVE-2026-5355021Monitor
js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
MediumCVSS 5.3No exploitEPSS 0%nodeca · js-yamlJun 22, 2026