From 1cbef2475c24090958fbe886e425e9826d09d8c0 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 17 Sep 2026 16:23:07 +0300 Subject: [PATCH] CVE-2026-84375 GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources in openam-ui-api (4.3.1 -> 4.3.2) --- openam-ui/openam-ui-api/package-lock.json | 6 +++--- openam-ui/openam-ui-api/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/openam-ui/openam-ui-api/package-lock.json b/openam-ui/openam-ui-api/package-lock.json index 2f37171e52..442f9cf377 100644 --- a/openam-ui/openam-ui-api/package-lock.json +++ b/openam-ui/openam-ui-api/package-lock.json @@ -762,9 +762,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { diff --git a/openam-ui/openam-ui-api/package.json b/openam-ui/openam-ui-api/package.json index f5aecf862d..da5d0f21d1 100644 --- a/openam-ui/openam-ui-api/package.json +++ b/openam-ui/openam-ui-api/package.json @@ -16,7 +16,7 @@ "swagger-ui-dist": ">=5.29.0" }, "overrides": { - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.2", "grunt": { "lodash": "$lodash" }