swagger-parser-10.1.1.tgz: 3 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - swagger-parser-10.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: e818b480b07718e2c28c29d37aba55e1822b2534

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (swagger-parser version)	Remediation Possible**
CVE-2026-59869	High	7.5	js-yaml-4.1.1.tgz	Transitive	N/A*	❌
CVE-2026-15195	Medium	6.3	json-schema-ref-parser-11.7.2.tgz	Transitive	N/A*	❌
CVE-2026-53550	Medium	5.3	js-yaml-4.1.1.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-59869

Vulnerable Library - js-yaml-4.1.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• swagger-parser-10.1.1.tgz (Root Library)
  • json-schema-ref-parser-11.7.2.tgz
    • ❌ js-yaml-4.1.1.tgz (Vulnerable Library)

Found in HEAD commit: e818b480b07718e2c28c29d37aba55e1822b2534

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Publish Date: 2026-07-08

URL: CVE-2026-59869

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-08

Fix Resolution: https://github.com/nodeca/js-yaml.git - 4.3.0,https://github.com/nodeca/js-yaml.git - 3.15.0,js-yaml - 4.3.0,js-yaml - 3.15.0,js-yaml - 4.3.0,js-yaml - 3.15.0

CVE-2026-15195

Vulnerable Library - json-schema-ref-parser-11.7.2.tgz

Parse, Resolve, and Dereference JSON Schema $ref pointers

Library home page: https://registry.npmjs.org/@⁠apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-11.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• swagger-parser-10.1.1.tgz (Root Library)
  • ❌ json-schema-ref-parser-11.7.2.tgz (Vulnerable Library)

Found in HEAD commit: e818b480b07718e2c28c29d37aba55e1822b2534

Found in base branch: main

Vulnerability Details

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component.

Publish Date: 2026-07-09

URL: CVE-2026-15195

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-09

Fix Resolution: https://github.com/APIDevTools/json-schema-ref-parser.git - v15.3.6,@⁠apidevtools/json-schema-ref-parser - 15.3.6

CVE-2026-53550

Vulnerable Library - js-yaml-4.1.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• swagger-parser-10.1.1.tgz (Root Library)
  • json-schema-ref-parser-11.7.2.tgz
    • ❌ js-yaml-4.1.1.tgz (Vulnerable Library)

Found in HEAD commit: e818b480b07718e2c28c29d37aba55e1822b2534

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

Publish Date: 2026-06-22

URL: CVE-2026-53550

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-15

Fix Resolution: https://github.com/nodeca/js-yaml.git - 4.2.0