Nodeca vulnerabilities
We track 6 vulnerabilities in Nodeca products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2026.
Latest Nodeca vulnerabilities
- 7.5 High severity
probe-image-size: Uncontrolled Resource Consumption
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacke
- 7.5 High severity
js-yaml: Uncontrolled Resource Consumption
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequen
- 7.5 High severity
js-yaml: Inefficient Algorithmic Complexity
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and
- 7.5 High severity
js-yaml: Allocation of Resources Without Limits or Throttling
js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consump
- 7.5 High severity
js-yaml: Inefficient Algorithmic Complexity
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the
- 7.5 High severity
js-yaml: Allocation of Resources Without Limits or Throttling
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the