CVE-2026-73643

About vulnerability

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2.

Affected product:

11ty-gray-matter , @content-collections/mdx , @expo/build-tools , @ledgerhq/lumen-ui-rnative , @lg-tools/meta , AngularJS , Babel , Bouncy Castle , ComposioHQ/composio , EndemolShineGroup/cosmiconfig-typescript-loader , Express , Next.js , Node.js , React , Vue , adk-js , aegir , ag-ui-adk-js , ag-ui-mastra , allure-ava , allure-codeceptjs , allure-js , analog , analogjs-astro-angular , analogjs-platform , analogjs-router , analogjs-storybook-angular , analogjs-vite-plugin-angular , analogjs-vite-plugin-nitro , angular-devkit-build-angular , angular-pwa , anomalyco/opencode , apidevtools-json-schema-ref-parser , apollo , apollo-server , appium , appkit , apply-release-plan , arcjet-js , arcjet-logger , arcjet-skills , assetgraph , astro , astro-expressive-code , astrojs-cloudflare , astrojs-internal-helpers , astrojs-markdoc , astrojs-markdown-remark , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-preact , astrojs-prism , astrojs-react , astrojs-solid-js , astrojs-starlight , astrojs-studio , astrojs-svelte , astrojs-tailwind , astrojs-underscore-redirects , astrojs-upgrade , astrojs-vercel , astrojs-vue , async-storage , ava , aws-cdk , aws-lambda , azion , b4a , babel-code-frame , babel-core , babel-eslint , babel-eslint-parser , babel-generator , babel-helper-builder-react-jsx-experimental , babel-jest , babel-parser , babel-plugin-istanbul , babel-plugin-proposal-class-properties , babel-plugin-proposal-decorators , babel-plugin-proposal-nullish-coalescing-operator , babel-plugin-proposal-numeric-separator , babel-plugin-proposal-optional-chaining , babel-plugin-remove-graphql-queries , babel-plugin-syntax-async-generators , babel-plugin-syntax-export-namespace-from , babel-plugin-syntax-hermes-parser , babel-plugin-syntax-logical-assignment-operators , babel-plugin-syntax-numeric-separator , babel-plugin-syntax-optional-catch-binding , babel-plugin-transform-flow-strip-types , babel-plugin-transform-object-assign , babel-plugin-transform-react-display-name , babel-plugin-transform-react-jsx , babel-preset-expo , babel-preset-jest , babel-preset-react , babel-traverse , babel-types , bare-fs , bare-stream , berry , blake2b , blake2b-wasm , blockchain-link-utils , blockstack.js , bls12377js , browsers , bson-transpilers , build , bun-dedup , callstack-repack , callstack-repack-init , callstack-repack-plugin-expo-modules , callstack-repack-plugin-nativewind , callstack-repack-plugin-reanimated , cdk , celo-celocli , celo-connect , celo-contractkit , celo-utils , celo-wallet-base , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , changesets , changesets-release-utils , clerk-astro , clerk-clerk-expo , clerk-expo , clerk-expo-biometrics , clerk-expo-google-signin , clerk-expo-native-components , clerk-expo-passkeys , clerk-tanstack-react-start , clerk-upgrade , cli-ux , cloud-sdk-js , codeceptjs , codecov , coin-modules , comark , commit-analyzer , commitlint , commitlint-cli , commitlint-core , commitlint-cz-commitlint , commitlint-load , commitlint-prompt , commitlint-prompt-cli , commitlint-travis-cli , composio-anthropic , config , config-inspector , config-plugins , configstore , configure , confluent-kafka-javascript , cosmiconfig , cosmiconfig-typescript-loader , create-factory , create-instantsearch-app , create-jest , create-medplum , create-module-federation , create-react-app , create-rock , create-rspack , create-sanity , create-storybook , create-strapi , create-strapi-app , create-turbo , create-video , create-yarn-workspaces , create-zephyr-apps , crystal , css-loader , cssnano , cssnano-preset-default , csstools-css-color-parser , csstools-css-parser-algorithms , csstools-postcss-color-mix-function , csstools-postcss-logical-viewport-units , csstools-postcss-media-queries-aspect-ratio-number-values , csstools-postcss-relative-color-syntax , csstools-postcss-scope-pseudo-class , csstools-postcss-todo-or-die , csstools-stylelint-no-invalid-at-import-rules-when-bundling , cz-cli , cz-conventional-changelog , datadog-ci , db , dd-trace , dd-wasm-js-rewriter , deepeval , depcheck , deps-resolver , developer-tooling , devtools , diff-sequences , docsearch , documentation , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , docusaurus-utils , docusaurus-utils-validation , eas-cli , ecosystem , effect , effect-ai-anthropic , effect-ai-cloudflare , effect-ai-openai , effect-ai-openai-compat , effect-ai-openrouter , effect-ai-typesafe , effect-atom-react , effect-atom-solid , effect-atom-vue , effect-docgen , effect-doctest , effect-openapi-generator , effect-opentelemetry , effect-platform-browser , effect-platform-bun , effect-platform-deno , effect-platform-node , effect-sql-clickhouse , effect-sql-d1 , effect-sql-libsql , effect-sql-mssql , effect-sql-mysql2 , effect-sql-pg , effect-sql-pglite , effect-sql-sqlite-bun , effect-sql-sqlite-do , effect-sql-sqlite-node , effect-sql-sqlite-react-native , effect-sql-sqlite-wasm , effect-vitest , electron-installer-snap , electron-mocha , electron-webpack , elements , ember-cli , emotion , emotion-babel-plugin , emotion-native , emotion-primitives , emotion-primitives-core , emotion-styled , endo , endo-captp , endo-check-bundle , endo-compartment-mapper , endo-errors , endo-far , endo-init , endo-lockdown , endo-lp32 , endo-promise-kit , enzyme-matchers , eslint , eslint-community-eslint-plugin-eslint-comments , eslint-community/eslint-utils , eslint-compat-utils , eslint-config-airbnb-base , eslint-config-expo , eslint-config-fb-strict , eslint-config-ipfs , eslint-config-love , eslint-config-prettier , eslint-config-react-app , eslint-config-standard , eslint-config-universe , eslint-etc , eslint-formatters , eslint-import-resolver-typescript , eslint-loader , eslint-plugin-babel , eslint-plugin-compat , eslint-plugin-deprecation , eslint-plugin-es , eslint-plugin-es-x , eslint-plugin-eslint-comments , eslint-plugin-etc , eslint-plugin-expo , eslint-plugin-flowtype , eslint-plugin-formatjs , eslint-plugin-ft-flow , eslint-plugin-graphql , eslint-plugin-header , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsdoc , eslint-plugin-jsx-a11y , eslint-plugin-lit , eslint-plugin-lit-a11y , eslint-plugin-mocha , eslint-plugin-n , eslint-plugin-node , eslint-plugin-playwright , eslint-plugin-prettier , eslint-plugin-promise , eslint-plugin-react , eslint-plugin-react-hooks , eslint-plugin-react-native , eslint-plugin-react-refresh , eslint-plugin-simple-import-sort , eslint-plugin-standard , eslint-plugin-storybook , eslint-plugin-testing-library , eslint-plugin-turbo , eslint-plugin-vue , eslint-plugin-wc , eslint-plugin-wdio , eslint-rewrite , eslint-stylistic , eslint-utils , eslint-webpack-plugin , eslintrc , executor , expect-webdriverio , expo , expo-app-integrity , expo-app-intents , expo-app-loading , expo-apple-authentication , expo-application , expo-asset , expo-audio , expo-auth-session , expo-av , expo-background-fetch , expo-background-task , expo-barcode-scanner , expo-battery , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-calendar , expo-camera , expo-cli , expo-clipboard , expo-config , expo-configure-splash-screen , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-client-components , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-dev-tools , expo-device , expo-document-picker , expo-electron-adapter , expo-env-info , expo-error-recovery , expo-expo-cli , expo-file-system , expo-firebase-analytics , expo-firebase-core , expo-firebase-recaptcha , expo-font , expo-gl , expo-glass-effect , expo-google-app-auth , expo-haptics , expo-hinge , expo-image , expo-image-loader , expo-image-picker , expo-image-utils , expo-insights , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-local-build-cache-provider , expo-localization , expo-location , expo-log-box-utils , expo-mail-composer , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-cli , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-notifications , expo-package-manager , expo-permissions , expo-plugin-help , expo-prebuild-config , expo-print , expo-processing , expo-pwa , expo-random , expo-router , expo-router-server , expo-schemer , expo-screen-capture , expo-screen-orientation , expo-secure-store , expo-sensors , expo-sharing , expo-sms , expo-speech , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-store-review , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-tracking-transparency , expo-updates , expo-updates-interface , expo-vector-icons , expo-video , expo-video-thumbnails , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , fast-check , fastly-http-compute-js , fbjs , flow-api-translator , focus-reactive-react-yaml , forge , fork-ts-checker-webpack-plugin , front-matter , fuma-content , fuma-content-studio , fumadocs , fumadocs-base-ui , fumadocs-content , fumadocs-content-collections , fumadocs-mdx-remote , fumadocs-obsidian , fumadocs-openapi , fumadocs-python , fumadocs-sanity , fumadocs-ui , gapic-node-processing , gateway , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-subfont , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-sharp , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , get-workspaces , github , globalart-nestjs-zod , google-adk , google-adk-integrations , gp-js-client , grafast , grafserv , graph-builder , graphile-config , graphile-export , graphql-code-generator , graphql-codegen-add , graphql-codegen-client-preset , graphql-codegen-core , graphql-codegen-gql-tag-operations , graphql-codegen-plugin-helpers , graphql-codegen-schema-ast , graphql-codegen-typed-document-node , graphql-codegen-typescript , graphql-codegen-typescript-document-nodes , graphql-codegen-typescript-resolvers , graphql-config , graphql-hive-cli , graphql-hive-envelop , graphql-hive-gateway , graphql-hive-gateway-plugin-console-sdk , graphql-hive-gateway-runtime , graphql-hive-gateway-testing , graphql-hive-logger-pino , graphql-hive-plugin-aws-sigv4 , graphql-hive-plugin-opentelemetry , graphql-hive-router-runtime , graphql-inspector , graphql-inspector-ci , graphql-inspector-git-loader , graphql-inspector-graphql-loader , graphql-inspector-url-loader , graphql-language-service-server , graphql-mesh , graphql-mesh-cache-cfw-kv , graphql-mesh-cache-file , graphql-mesh-cache-inmemory-lru , graphql-mesh-cache-localforage , graphql-mesh-cache-redis , graphql-mesh-cli , graphql-mesh-compose-cli , graphql-mesh-config , graphql-mesh-fusion-composition , graphql-mesh-fusion-runtime , graphql-mesh-graphql , graphql-mesh-grpc , graphql-mesh-hmac-upstream-signature , graphql-mesh-http , graphql-mesh-incontext-sdk-codegen , graphql-mesh-json-schema , graphql-mesh-merger-stitching , graphql-mesh-migrate-config-cli , graphql-mesh-mongoose , graphql-mesh-mysql , graphql-mesh-neo4j , graphql-mesh-odata , graphql-mesh-openapi , graphql-mesh-plugin-deduplicate-request , graphql-mesh-plugin-hive , graphql-mesh-plugin-http-cache , graphql-mesh-plugin-http-details-extensions , graphql-mesh-plugin-jit , graphql-mesh-plugin-live-query , graphql-mesh-plugin-mock , graphql-mesh-plugin-newrelic , graphql-mesh-plugin-opentelemetry , graphql-mesh-plugin-operation-field-permissions , graphql-mesh-plugin-operation-headers , graphql-mesh-plugin-prometheus , graphql-mesh-plugin-rate-limit , graphql-mesh-plugin-response-cache , graphql-mesh-plugin-snapshot , graphql-mesh-plugin-statsd , graphql-mesh-raml , graphql-mesh-runtime , graphql-mesh-store , graphql-mesh-supergraph , graphql-mesh-thrift , graphql-mesh-transform-cache , graphql-mesh-transform-encapsulate , graphql-mesh-transform-extend , graphql-mesh-transform-federation , graphql-mesh-transform-filter-schema , graphql-mesh-transform-hive , graphql-mesh-transform-hoist-field , graphql-mesh-transform-naming-convention , graphql-mesh-transform-prefix , graphql-mesh-transform-prune , graphql-mesh-transform-rate-limit , graphql-mesh-transform-rename , graphql-mesh-transform-replace-field , graphql-mesh-transform-resolvers-composition , graphql-mesh-transform-transfer-schema , graphql-mesh-transform-type-merging , graphql-mesh-transport-grpc , graphql-mesh-transport-http , graphql-mesh-transport-http-callback , graphql-mesh-transport-mysql , graphql-mesh-transport-odata , graphql-mesh-transport-soap , graphql-mesh-transport-sqlite , graphql-mesh-transport-thrift , graphql-mesh-transport-ws , graphql-mesh-tuql , graphql-mesh-types , graphql-mesh-urql-exchange , graphql-mesh-utils , graphql-tools , graphql-tools-code-file-loader , graphql-tools-executor-yoga , graphql-tools-github-loader , graphql-tools-jest-transform , graphql-tools-relay-operation-optimizer , gray-matter , grunt , grunt-karma , gutenberg , hardhat , hermes , hey-api , hey-api-client-axios , hey-api-client-fetch , hey-api-json-schema-ref-parser , hiero-sdk-js , hindsight , htmlnano , istanbul , istanbul-api , istanbuljs , istanbuljs-nyc-config-babel , jest , jest-chain-transform , jest-circus , jest-cli , jest-config , jest-core , jest-diff , jest-diff-sequences , jest-docblock , jest-editor-support , jest-environment , jest-environment-jsdom , jest-environment-jsdom-abstract , jest-environment-node , jest-expect , jest-expect-openapi , jest-expo , jest-expo-enzyme , jest-fake-timers , jest-get-type , jest-globals , jest-haste-map , jest-image-snapshot , jest-jasmine2 , jest-matcher-utils , jest-message-util , jest-mock , jest-preset-angular , jest-regex-util , jest-repl , jest-reporters , jest-resolve-dependencies , jest-runner , jest-runtime , jest-snapshot , jest-snapshot-utils , jest-specific-snapshot , jest-test-result , jest-test-sequencer , jest-test-typescript-parser , jest-transform , jest-types , jest-util , jest-validate , jest-watch-typeahead , js-compute-runtime , js-yaml , js-yaml-js-types , json-refs , json-schema-ref-parser , json-schema-to-typescript , junit-report-merger , karma-coverage-istanbul-reporter , kubernetes-client-node , langchain , langchain-classic , langchain-community , lazy-node-semver-ampersand , leafygreen-ui , leafygreen-ui-a11y , leafygreen-ui-chip , leafygreen-ui-code , leafygreen-ui-combobox , leafygreen-ui-compound-component , leafygreen-ui-date-picker , leafygreen-ui-guide-cue , leafygreen-ui-hooks , leafygreen-ui-input-option , leafygreen-ui-search-input , leafygreen-ui-select , leafygreen-ui-skeleton-loader , leafygreen-ui-table , leafygreen-ui-testing-lib , leafygreen-ui-text-input , leafygreen-ui-toggle , leafygreen-ui-typography , ledger-live , ledgerhq-coin-algorand , ledgerhq-coin-aptos , ledgerhq-coin-canton , ledgerhq-coin-concordium , ledgerhq-coin-cosmos , ledgerhq-coin-near , ledgerhq-coin-polkadot , ledgerhq-crypto-icons , ledgerhq-crypto-icons-ui , ledgerhq-domain-service , ledgerhq-hw-app-near , ledgerhq-hw-transport , ledgerhq-hw-transport-mocker , ledgerhq-hw-transport-node-hid-noevents , ledgerhq-hw-transport-node-speculos , ledgerhq-hw-transport-web-ble , ledgerhq-hw-transport-webusb , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-live-countervalues , ledgerhq-native-ui , lerna , lerna-conventional-commits , lg-charts-colors , lg-chat-message-prompts , lg-chat-message-rating , lg-chat-rich-links , lg-chat-title-bar , lg-tools-cli , lg-tools-codemods , lg-tools-create , lg-tools-install , lg-tools-link , lg-tools-prompt-kit , lg-tools-slackbot , lg-tools-storybook-addon , lg-tools-storybook-decorators , lg-tools-test , lg-tools-validate , libp2p-interface-compliance-tests , libp2p-interfaces-compliance-tests , libp2p-interop , lingui-babel-plugin-lingui-macro , lingui-conf , lingui-detect-locale , lingui-format-csv , lingui-format-json , lingui-format-po , lingui-format-po-gettext , livestore , livestore-webmesh , load-nyc-config , load-yaml-file , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , lottie-react-native , lucide , lucide-astro , lucide-icons , lucide-preact , lucide-react-native , lucide-solid , lucide-static , lucide-svelte , lucide-vue , magic-js , manypkg , markdown-toc , markdownlint-cli , masked-view , mastra , mastra-agent-builder , mastra-ai-sdk , mastra-arize , mastra-arthur , mastra-auth , mastra-auth-auth0 , mastra-auth-better-auth , mastra-auth-clerk , mastra-auth-cloud , mastra-auth-firebase , mastra-auth-neon , mastra-auth-okta , mastra-auth-studio , mastra-blaxel , mastra-braintrust , mastra-browser-viewer , mastra-clickhouse , mastra-client-js , mastra-cloudflare , mastra-cloudflare-d1 , mastra-code-sdk , mastra-connect , mastra-core , mastra-datadog , mastra-daytona , mastra-deepeval , mastra-deployer , mastra-deployer-netlify , mastra-deployer-sandbox , mastra-deployer-vercel , mastra-discord , mastra-docker , mastra-dsql , mastra-e2b , mastra-editor , mastra-elysia , mastra-evals , mastra-express , mastra-factory , mastra-fastembed , mastra-google-cloud-pubsub , mastra-hono , mastra-inngest , mastra-koa , mastra-langfuse , mastra-langsmith , mastra-loggers , mastra-longmemeval , mastra-mcp , mastra-mcp-docs-server , mastra-mongodb , mastra-mysql , mastra-nestjs , mastra-observability , mastra-opencode , mastra-oracledb , mastra-otel-bridge , mastra-playground-ui , mastra-posthog , mastra-quickjs , mastra-react , mastra-s3 , mastra-s3vectors , mastra-sentry , mastra-server-adapters-test-suite , mastra-slack , mastra-spanner , mastra-tanstack-start , mastra-tavily , mastra-teams , mastra-temporal , mastra-turso , mastra-valkey , mastra-valkey-streams , mastra-vercel , mastra-weaviate , mastracode , material-ui , mdx , mdx-bundler , medplum , medplum-agent , medplum-app , medplum-bot-layer , medplum-ccda , medplum-cdk , medplum-cli , medplum-core , medplum-definitions , medplum-dosespot-core , medplum-dosespot-react , medplum-eslint-config , medplum-fhir-router , medplum-fhirtypes , medplum-health-gorilla-core , medplum-health-gorilla-react , medplum-hl7 , medplum-mock , medplum-react , medplum-react-hooks , medplum-react-scheduling , medplum-scriptsure-react , metalsmith , metalsmith-in-place , metamask-core , metamask-snaps-cli , metamask-snaps-jest , metro , metro-babel-transformer , metro-cache , metro-config , metro-hermes-compiler , metro-inspector-proxy , metro-react-native-babel-preset , metro-react-native-babel-transformer , metro-react-native-interop-tools , metro-transform-plugins , metro-transform-worker , microsoft-365-agents-toolkit , microsoft-api-documenter , microsoft-rush , microsoft-rush-lib , middleware , mocha , modern-js-adapter-rstest , modern-js-app-tools , modern-js-babel-compiler , modern-js-babel-plugin-module-resolver , modern-js-babel-preset , modern-js-base-generator , modern-js-builder , modern-js-core , modern-js-flight-server-transform-plugin , modern-js-generator-utils , modern-js-plugin-bff , modern-js-plugin-i18n , modern-js-plugin-polyfill , modern-js-prod-server , modern-js-rsbuild-plugin-esbuild , modern-js-server , modern-js-server-core , modern-js-server-utils , modern-js-tsconfig , modern-js-uni-builder , modern-js-utils , modern.js , module-federation-bridge-react-webpack-plugin , module-federation-bridge-shared , module-federation-bridge-vue3 , module-federation-core , module-federation-data-prefetch , module-federation-devtools , module-federation-error-codes , module-federation-managers , module-federation-modern-js , module-federation-retry-plugin , module-federation-rsbuild-plugin , module-federation-runtime , module-federation-runtime-core , module-federation-runtime-tools , module-federation-third-party-dts-extractor , module-federation-webpack-bundler-runtime , module-federation/core , mongodb-js-eslint-config-devtools , mongodb-js-mongodb-ts-autocomplete , mongodb-js-sbom-tools , mongodb-schema , monorepo , mui-codemod , mui-docs , mui-icons-material , mui-material , mui-material-pigment-css , mui-styles , mux-mux-player-react , mysten-codegen , mysten-create-dapp , mysten-docs , napi-rs-cli , neostandard , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-core , netlify-dev , netlify-vite-plugin , newrelic-security-agent , nitro , nomicfoundation-hardhat-ethers , npm-check , npm-check-updates , npm-init2 , npm-lifecycle , npm-package-json-lint , npm-package-json-lint-config-default , npm-package-json-loader , npm:@pnpm/exec.lifecycle , npm:@pnpm/exec.prepare-package , npm:@pnpm/installing.linking.hoist , npm:@pnpm/installing.modules-yaml , npm:gatsby-theme-blog-core , nuxt , nuxt-docs , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nx , nx-angular , nx-cypress , nx-devkit , nx-jest , nx-js , nx-module-federation , nx-plugin , nx-vite , nx-web , nx-workspace , nyc , oas-normalize , oclif-plugin-autocomplete , oclif-plugin-not-found , oclif-plugin-plugins , oclif-plugin-warn-if-update-available , oclif/core , octanejs-astro , octanejs-docusaurus , octanejs-tanstack-start , octokit-plugin-config , office-addin-debugging , office-addin-dev-settings , okta-sdk-nodejs , omnigraph-json-schema , omnigraph-mysql , omnigraph-neo4j , omnigraph-openapi , omnigraph-soap , omnigraph-thrift , onflow-fcl-react-native , open-wc-eslint-config , open-wc-testing-karma , open-wc-testing-karma-bs , openapi-contrib-openapi-schema-to-json-schema , openapi-typescript , openapi-typescript-codegen , opencode , opencode-ai , opencode-cli , opencode-codemode , opencode-plugin , opencode-plugin-browser , opencode-schema , opencode-sdk , opencode-simulation , opencode-theme , opencode-util , optimize-css-assets-webpack-plugin , orama-orama , orval , orval-angular , orval-axios , orval-core , orval-effect , orval-fetch , orval-hono , orval-mcp , orval-mock , orval-pinia-colada , orval-query , orval-solid-start , orval-swr , oxc , packages , panda , pandacss-mcp , pandacss-types , parcel , parcel-bundler , parcel-bundler-default , parcel-events , parcel-feature-flags , parcel-markdown-ansi , parcel-namer-default , parcel-optimizer-css , parcel-optimizer-html , parcel-optimizer-image , parcel-optimizer-swc , parcel-packager-css , parcel-packager-html , parcel-packager-js , parcel-reporter-dev-server , parcel-runtime-browser-hmr , parcel-runtime-js , parcel-runtime-rsc , parcel-runtime-service-worker , parcel-rust , parcel-rust-linux-arm64-gnu , parcel-rust-linux-arm64-musl , parcel-rust-linux-x64-gnu , parcel-transformer-babel , parcel-transformer-css , parcel-transformer-html , parcel-transformer-json , parcel-transformer-node , parcel-transformer-postcss , parcel-transformer-posthtml , parcel-transformer-svg , parcel-utils , parse , patch-project , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-client , percy-core , percy-monitoring , percy-webdriver-utils , pg-introspection , pigment-css , plugin-commands , plugin-help , plugin-warn-if-update-available , pm-tools , pm2 , pnpm , pnpm-auth.commands , pnpm-bins.cmd-shim , pnpm-bins.linker , pnpm-building.after-install , pnpm-cache.commands , pnpm-catalogs.protocol-parser , pnpm-catalogs.types , pnpm-cli.commands , pnpm-cli.common-cli-options-help , pnpm-cli.default-reporter , pnpm-cli.meta , pnpm-cli.parse-cli-args , pnpm-config.commands , pnpm-config.matcher , pnpm-config.parse-overrides , pnpm-config.pick-registry-for-package , pnpm-config.writer , pnpm-crypto.object-hasher , pnpm-dedup , pnpm-deps.compliance.license-resolver , pnpm-deps.compliance.license-scanner , pnpm-deps.compliance.sbom , pnpm-deps.graph-sequencer , pnpm-deps.inspection.commands , pnpm-deps.inspection.list , pnpm-deps.inspection.tree-builder , pnpm-deps.status , pnpm-engine.pm.commands , pnpm-exec.npm-lifecycle , pnpm-fetching.directory-fetcher , pnpm-fetching.git-fetcher , pnpm-fetching.pick-fetcher , pnpm-fetching.tarball-fetcher , pnpm-fetching.types , pnpm-fs.indexed-pkg-importer , pnpm-fs.is-empty-dir-or-nothing , pnpm-installing.client , pnpm-installing.context , pnpm-installing.dedupe.check , pnpm-installing.linking.direct-dep-linker , pnpm-installing.package-requester , pnpm-installing.read-projects-context , pnpm-lockfile.make-dedicated-lockfile , pnpm-lockfile.peer-edges , pnpm-lockfile.preferred-versions , pnpm-lockfile.pruner , pnpm-lockfile.settings-checker , pnpm-lockfile.to-pnp , pnpm-lockfile.types , pnpm-lockfile.verification , pnpm-modules-mounter.daemon , pnpm-network.git-utils , pnpm-os.env.path-extender-posix , pnpm-pkg-manifest.commands , pnpm-pkg-manifest.reader , pnpm-prepare , pnpm-prepare-temp-dir , pnpm-registry-access.commands , pnpm-releasing.versioning , pnpm-resolving.default-resolver , pnpm-resolving.local-resolver , pnpm-resolving.registry.types , pnpm-resolving.tarball-resolver , pnpm-store.commands , pnpm-store.controller , pnpm-store.controller-types , pnpm-store.index , pnpm-store.pkg-finder , pnpm-sync , pnpm-workspace.commands , pnpm-workspace.injected-deps-syncer , pnpm-workspace.project-manifest-reader , pnpm-workspace.project-manifest-writer , pnpm-workspace.projects-reader , pnpm-workspace.range-resolver , pnpm-workspace.root-finder , pnpm-workspace.state , pnpm-workspace.workspace-manifest-writer , portabletext-keyboard-shortcuts , portabletext-patches , portabletext-plugin-dnd , portabletext-plugin-list-index , portabletext-plugin-table , postcss-gap-properties , postcss-load-config , postcss-load-options , postcss-load-plugins , postcss-loader , postcss-overflow-shorthand , postcss-place , postcss-svgo , pptr-testing-library , pre , preferred-pm , prettyhtml , probot , puppeteer , puppeteer-core , query , racejar , rc-config-loader , read-config-file , read-yaml-file , readme-openapi-parser , readme-postman-to-openapi , redoc , redocly-cli , redocly-openapi-core , redocly-recheck , redocly-respect-core , redocly-reunite-integration , rehype-expressive-code , relay , release-notes-generator , remark-cli , remark-mdx-frontmatter , remix , remix-run-server-runtime , remotion , remotion-animated-emoji , remotion-animation-utils , remotion-babel-loader , remotion-browser-bundler , remotion-bundler , remotion-captions , remotion-cli , remotion-cloudrun , remotion-codemods , remotion-compositor-darwin-arm64 , remotion-compositor-darwin-x64 , remotion-compositor-linux-arm64-gnu , remotion-compositor-linux-arm64-musl , remotion-compositor-linux-x64-gnu , remotion-compositor-linux-x64-musl , remotion-compositor-win32-x64-msvc , remotion-design , remotion-effects , remotion-elevenlabs , remotion-enable-scss , remotion-eslint-config , remotion-eslint-config-flat , remotion-eslint-plugin , remotion-fonts , remotion-gif , remotion-google-fonts , remotion-gsap , remotion-install-whisper-cpp , remotion-lambda , remotion-lambda-client , remotion-layout-utils , remotion-licensing , remotion-light-leaks , remotion-lottie , remotion-mac-cursors , remotion-maptiler , remotion-mcp , remotion-media , remotion-media-parser , remotion-media-utils , remotion-motion-blur , remotion-noise , remotion-openai-whisper , remotion-paths , remotion-player , remotion-preload , remotion-promo-pages , remotion-renderer , remotion-rive , remotion-rough-notation , remotion-rounded-text-box , remotion-sdk , remotion-serverless , remotion-serverless-client , remotion-sfx , remotion-shapes , remotion-skia , remotion-starburst , remotion-streaming , remotion-studio , remotion-studio-protocol , remotion-studio-server , remotion-studio-shared , remotion-svg-3d-engine , remotion-tailwind , remotion-tailwind-v4 , remotion-three , remotion-timeline-utils , remotion-transitions , remotion-vercel , remotion-video-matting , remotion-web-renderer , remotion-webcodecs , remotion-whisper-web , remotion-whisper-webgpu , remotion-zod-types , remotion-zod-types-v3 , remove , reown-appkit , reown-appkit-adapter-bitcoin , reown-appkit-adapter-ethers , reown-appkit-adapter-ethers5 , reown-appkit-adapter-solana , reown-appkit-adapter-wagmi , reown-appkit-common , reown-appkit-controllers , reown-appkit-core , reown-appkit-experimental , reown-appkit-scaffold-ui , reown-appkit-siwe , reown-appkit-siwx , reown-appkit-ui , reown-appkit-utils , reown-appkit-wallet , reown-appkit-wallet-button , repack , rock , rock-js-platform-apple-helpers , rock-js-platform-ios , rock-js-plugin-brownfield-ios , rock-js-plugin-expo-config-plugins , rock-js-provider-github , rock-js-template-default , rollup-plugin-zephyr , rsbuild , rsbuild-plugin-react , rsbuild-plugin-type-check , rsdoctor , rsdoctor-components , rsdoctor-docs , rsdoctor-webpack-plugin , rspack , rspack-binding , rspack-cli , rspack-test-tools , rspress , runtime-cli , rushstack , rushstack-eslint-config , rushstack-eslint-plugin , rushstack-eslint-plugin-packlets , rushstack-eslint-plugin-security , rushstack-heft-isolated-typescript-transpile-plugin , rushstack-heft-jest-plugin , rushstack-heft-node-rig , rushstack-heft-sass-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-lockfile-explorer , rushstack-lookup-by-path , rushstack-package-extractor , rushstack-rush-amazon-s3-build-cache-plugin , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-bridge-cache-plugin , rushstack-rush-cli-client , rushstack-rush-serve-plugin , safe-global-testing-kit , sanity , sanity-access-ui , sanity-cli , sanity-cli-build , sanity-diff , sanity-mutator , sanity-plugin-mux-input , sanity-preview-url-secret , sanity-schema , sanity-types , sanity-util , sanity-vercel-protection-bypass , sanity-vision , sap-cloud-sdk-http-client , sap-cloud-sdk-openapi , sap-cloud-sdk-resilience , sap-cloud-sdk-util , sb , scalar-astro , scalar-docusaurus , scalar-starlight , sdk-typescript , secretlint , secretlint-config-loader , secretlint-core , secretlint-formatter , secretlint-node , semantic-release , semantic-release-changelog , semantic-release-git , semantic-release-monorepo , semantic-release-npm , semantic-release-plugin-decorators , sentry-astro , sentry-browser , sentry-core , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node , sentry-node-native , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-types , sentry-typescript , sentry-wasm , services , shadcn , shadcn-registry , sharp , shifter , snyk-policy , solana-wallet-adapter-base-ui , solana-wallet-adapter-nufi , sort-package-json3 , sqip , stacks-auth , stacks-encryption , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-essentials , storybook-addon-links , storybook-addon-onboarding , storybook-addon-pseudo-states , storybook-addon-themes , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi , strapi-admin , strapi-cloud-cli , strapi-content-manager , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-database , strapi-email , strapi-generators , strapi-i18n , strapi-logger , strapi-openapi , strapi-permissions , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-mailgun , strapi-provider-email-sendgrid , strapi-provider-upload-aws-s3 , strapi-provider-upload-cloudinary , strapi-provider-upload-local , strapi-review-workflows , strapi-strapi , strapi-types , strapi-typescript-utils , strapi-upgrade , strapi-upload , strapi-utils , streamx , strong-globalize , strong-globalize-cli , strong-remoting , stx-labs-stacks.js , stx-labs/stacks.js , styled-components , stylelint , stylelint-config-recess-order , stylelint-config-recommended , stylelint-config-recommended-scss , stylelint-config-sass-guidelines , stylelint-no-unsupported-browser-features , stylelint-order , stylelint-scss , stylelint-stylistic , subfont , supertap , sveltedoc-parser , svgo , svgr , svgr-babel-plugin-add-jsx-attribute , svgr-babel-plugin-remove-jsx-empty-expression , svgr-babel-plugin-replace-jsx-attribute-value , svgr-babel-plugin-svg-em-dimensions , svgr-babel-plugin-transform-react-native-svg , svgr-babel-plugin-transform-svg-component , svgr-babel-preset , svgr-core , svgr-hast-util-to-babel-ast , svgr-plugin-jsx , svgr-plugin-prettier , svgr-plugin-svgo , svgr-rollup , swagger , swagger-js , swagger-parser , swagger-ui , sync-lockfile , tabler-icons , tabler-icons-angular , tabler-icons-astro , tabler-icons-png , tabler-icons-preact , tabler-icons-solidjs , tabler-icons-sprite , tabler-icons-vue , tabler-icons-webfont , tachyons-build-css , tachyons-generator , tanstack-ai-sandbox-blaxel , tanstack-angular-query-experimental , tanstack-browser-db-sqlite-persistence , tanstack-capacitor-db-sqlite-persistence , tanstack-cloudflare-durable-objects-db-sqlite-persistence , tanstack-eslint-plugin-query , tanstack-expo-db-sqlite-persistence , tanstack-node-db-sqlite-persistence , tanstack-query-async-storage-persister , tanstack-query-broadcast-client-experimental , tanstack-query-persist-client-core , tanstack-query-sync-storage-persister , tanstack-react-native-db-sqlite-persistence , tanstack-react-query-devtools , tanstack-react-query-next-experimental , tanstack-react-query-persist-client , tanstack-react-start , tanstack-react-start-rsc , tanstack-solid-query , tanstack-solid-query-devtools , tanstack-solid-query-persist-client , tanstack-solid-start , tanstack-start-plugin-core , tanstack-svelte-query , tanstack-svelte-query-devtools , tanstack-svelte-query-persist-client , tanstack-tauri-db-sqlite-persistence , tanstack-vue-query , tanstack-vue-start , tapjs , tar-fs , tar-stream , teex , temporalio-worker , testem , text-decoder , textlint-linter-formatter , theme-ui , tldts , tldts-experimental , tldts-icann , tldts-tests , tldts-utils , trezor-blockchain-link-types , trezor-connect-web , trezor-suite , ts-jest , tsdoc , tslint , tslint-consistent-codestyle , turbo-gen , turbo-types , turbo-workspaces , typescript-eslint , typescript-eslint-eslint-plugin , typescript-eslint-parser , typescript-eslint-project-service , typescript-eslint-rule-schema-to-typescript-types , typescript-eslint-rule-tester , typescript-eslint-scope-manager , typescript-eslint-tsconfig-utils , typescript-eslint-type-utils , typescript-eslint-types , typescript-eslint-typescript-estree , typescript-eslint-visitor-keys , unified-args , unified-engine , unimodules-permissions-interface , unimodules-sensors-interface , unimodules-task-manager-interface , up-require , vechain-sdk-js , vectorize-io-hindsight-client , vercel , vercel-backends , vercel-build-utils , vercel-cervel , vercel-client , vercel-elysia , vercel-express , vercel-fastify , vercel-frameworks , vercel-fs-detectors , vercel-gatsby-plugin-vercel-builder , vercel-h3 , vercel-hono , vercel-koa , vercel-nestjs , vercel-node , vercel-python , vercel-python-analysis , vercel-remix-builder , vercel-static-build , verdaccio , verdaccio-audit , verdaccio-auth , verdaccio-loaders , verdaccio-logger , verdaccio-signature , verdaccio-test-helper , verdaccio-ui-theme , verdaccio-utils , vetur , vfile-matter , vinxi , vite-plugin-istanbul , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , vitejs-devtools , vitejs-devtools-kit , vitest-eslint-plugin , volar-service-json , volar-service-pug , volar-service-pug-beautify , wallet-adapter , walletconnect-core , walletconnect-ethereum-provider , walletconnect-monorepo , walletconnect-sign-client , walletconnect-signer-connection , walletconnect-solana-adapter , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , wdio , wdio-ai-service , wdio-browser-runner , wdio-concise-reporter , wdio-config , wdio-display-server , wdio-firefox-profile-service , wdio-globals , wdio-jasmine-framework , wdio-json-reporter , wdio-lighthouse-service , wdio-local-runner , wdio-mocha-framework , wdio-runner , wdio-sauce-service , wdio-session , wdio-shared-store-service , wdio-smoke-test-reporter , wdio-static-server-service , wdio-sumologic-reporter , wdio-testingbot-service , wdio-utils , wdio-webdriver-mock-service , web-browser-logs , web-config-loader , web-dev-server-rollup , web-infra-dev/modern.js , web-storybook-framework-web-components , web-test-runner , web-test-runner-chrome , web-test-runner-commands , web-test-runner-core , web-test-runner-coverage-v8 , web-test-runner-junit-reporter , web-test-runner-mocha , web-test-runner-puppeteer , web-test-runner-selenium , web-test-runner-visual-regression , web-test-runner-webdriver , webdriver , webdriverio , webpack-cli-generators , which-pm , with-zephyr , wordpress-e2e-tests , wordpress-env , wordpress-eslint-plugin , wordpress-jest-console , wordpress-jest-preset-default , wordpress-npm-package-json-lint-config , wordpress-scripts , wordpress-stylelint-config , worker , workflow-world-postgres , workspaces-config , wotan , ws-node-novel , ws-pkg-list , ws-root-changelog , ws-yarn-workspaces , wyw-in-js , wyw-in-js-babel-preset , wyw-in-js-bun , wyw-in-js-cli , wyw-in-js-esbuild , wyw-in-js-parcel-transformer , wyw-in-js-rollup , wyw-in-js-transform , wyw-in-js-turbopack-loader , wyw-in-js-vite , wyw-in-js-webpack-loader , xdl , xmlbuilder2 , yaml-loader , yarn-berry-deduplicate , yarn-list-link , yarn-tool-changelog , yarn-tool-detect-yarnlock-version , yarn-tool-dotenv , yarn-tool-find-deps , yarn-tool-fix-all , yarn-tool-fix-ws-links , yarn-tool-fix-ws-pkgs-link , yarn-tool-fix-ws-versions , yarn-tool-get-pkg-bin , yarn-tool-init-path , yarn-tool-is-published , yarn-tool-ncu , yarn-tool-ncu-ws , yarn-tool-node-modules , yarn-tool-node-modules-is-alias , yarn-tool-node-modules-link , yarn-tool-normalize-deps-value , yarn-tool-npa-to-deps , yarn-tool-npa-to-deps-query , yarn-tool-npm-package-arg-util , yarn-tool-pack-package , yarn-tool-pkg-deps-add , yarn-tool-pkg-deps-util , yarn-tool-pkg-entry-util , yarn-tool-pkg-git-info , yarn-tool-pkg-hosted-info , yarn-tool-pkg-list-to-types , yarn-tool-pkg-name-to-types , yarn-tool-pkg-version-query , yarn-tool-publish-retry , yarn-tool-resolve-package , yarn-tool-run-script-lifecycle , yarn-tool-search-workspace-prefix-by-name , yarn-tool-sort-lerna-json , yarn-tool-sort-package-json-order , yarn-tool-tag , yarn-tool-version-recommended , yarn-tool-workspaces-project , yarn-tool-ws-changed , yarn-tool-ws-scope , yarn-tool-yarn-struct-utils , yarn-tool-yarnlock , yarn-tool-yarnlock-dedupe , yarn-tool-yarnlock-diff , yarn-tool-yarnlock-entries , yarn-tool-yarnlock-fs , yarn-tool-yarnlock-ncu , yarn-tool-yarnlock-parse , yarn-tool-yarnlock-parse-assert , yarn-tool-yarnlock-parse-raw , yarn-tool-yarnlock-parsed-to-json , yarn-tool-yarnlock-stringify , yarn-tool-yarnlock-types , yarn-tool-yarnlock-util , yarn-why-duplicate , yarnpkg-cli , yarnpkg-core , yarnpkg-doctor , yarnpkg-extensions , yarnpkg-nm , yarnpkg-plugin-catalog , yarnpkg-plugin-compat , yarnpkg-plugin-constraints , yarnpkg-plugin-dlx , yarnpkg-plugin-essentials , yarnpkg-plugin-exec , yarnpkg-plugin-file , yarnpkg-plugin-github , yarnpkg-plugin-interactive-tools , yarnpkg-plugin-jsr , yarnpkg-plugin-link , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-plugin-pnpm , yarnpkg-plugin-typescript , yarnpkg-plugin-version , yarnpkg-plugin-workspace-tools , yarnpkg-pnpify , yarnpkg-sdks , yarnpkg-shell , yeoman-generator , yeoman/environment , zag-js-accordion , zag-js-anatomy-icons , zag-js-checkbox , zag-js-docs , zag-js-focus-scope , zag-js-number-utils , zag-js-pin-input , zag-js-react , zag-js-slider , zag-js-solid , zag-js-tooltip , zag-js-vue , zbsearch , zbsearch-docs-index , zbsearch-edge-core , zbsearch-edge-index-builder , zbsearch-highlight , zbsearch-plugin-data-persistence , zbsearch-plugin-docusaurus , zbsearch-plugin-embeddings , zbsearch-plugin-match-highlight , zbsearch-plugin-parsedoc , zbsearch-plugin-pt15 , zbsearch-plugin-qps , zbsearch-plugin-starlight , zbsearch-plugin-vitepress , zbsearch-runtime-cloudflare , zbsearch-searchbox-core , zbsearch-searchbox-react , zbsearch-searchbox-vue , zbsearch-static , zbsearch-stemmers , zbsearch-stopwords , zbsearch-tokenizers , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-tap-runtime , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

js-yaml @ 4.3.1 (+32336 more)