{
  "@id": "urn:uuid:b1b89ec0-2c35-497c-9408-9b900a9cede7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T21:50:38.584018+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-64718 affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "CVE-2025-64718"
      },
      "action_statement": "Vulnerability CVE-2025-64718 affects version 4.0.0 of js-yaml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-53550 affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "CVE-2026-53550"
      },
      "action_statement": "Vulnerability CVE-2026-53550 affects version 4.0.0 of js-yaml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59868 affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "CVE-2026-59868"
      },
      "action_statement": "Vulnerability CVE-2026-59868 affects version 4.0.0 of js-yaml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59869 affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "CVE-2026-59869"
      },
      "action_statement": "Vulnerability CVE-2026-59869 affects version 4.0.0 of js-yaml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59870 affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "CVE-2026-59870"
      },
      "action_statement": "Vulnerability CVE-2026-59870 affects version 4.0.0 of js-yaml."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:50:00.055762+00:00",
      "status_notes": "Vulnerability CVE-2026-73643 does not affect version 4.0.0 of js-yaml. not_affected \u2014 js-yaml 4.0.0 (legacy JS loader, lib/loader.js) does not contain the rewind-and-reparse step that causes the exponential blowup. readFlowCollection parses each flow entry once, and the same node is used as the key if a ':' follows. The CVE's PoC runs in linear time here (n=1000 in about 7 ms).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-73643"
      },
      "impact_statement": "not_affected \u2014 js-yaml 4.0.0 (legacy JS loader, lib/loader.js) does not contain the rewind-and-reparse step that causes the exponential blowup. readFlowCollection parses each flow entry once, and the same node is used as the key if a ':' follows. The CVE's PoC runs in linear time here (n=1000 in about 7 ms)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-84375 affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "CVE-2026-84375"
      },
      "action_statement": "Vulnerability CVE-2026-84375 affects version 4.0.0 of js-yaml."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 4.0.0 of js-yaml.",
      "vulnerability": {
        "name": "GHSA-5p4m-2wfm-xmqj"
      },
      "action_statement": "Vulnerability GHSA-5p4m-2wfm-xmqj affects version 4.0.0 of js-yaml."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/js-yaml@4.0.0",
          "identifiers": {
            "purl": "pkg:npm/js-yaml@4.0.0"
          }
        }
      ],
      "timestamp": "2026-11-13T21:50:38.584018+00:00",
      "status_notes": "Vulnerability GHSA-pm4m-ph32-ghv5 does not affect version 4.0.0 of js-yaml. not_affected \u2014 js-yaml 4.0.0 does not have the exponential double-parse. readFlowCollection in lib/loader.js parses each flow entry once with composeNode. If a ':' follows, it reuses that parsed result as the key and parses only the value. There is no restoreState or rewind, so work stays linear in nesting depth. The advisory's PoC and several variants ran in single-digit milliseconds at depths from 22 to 90.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "GHSA-pm4m-ph32-ghv5"
      },
      "impact_statement": "not_affected \u2014 js-yaml 4.0.0 does not have the exponential double-parse. readFlowCollection in lib/loader.js parses each flow entry once with composeNode. If a ':' follows, it reuses that parsed result as the key and parses only the value. There is no restoreState or rewind, so work stays linear in nesting depth. The advisory's PoC and several variants ran in single-digit milliseconds at depths from 22 to 90."
    }
  ]
}