Packages / js-yaml / Security

ModerateVulnerabilityGHSA-mh29-5h37-fv8mCVE-2025-64718Published 14 Nov 2025

js-yaml has prototype pollution in merge (<<)

Your version

Affected releases · js-yaml

  • 4.x4.0.0 – 4.1.0Fixed in 4.1.1
  • 3.x3.0.0 – 3.14.1Fixed in 3.14.2
  • 2.x and older0.2.0 – 2.1.3No fix, no longer updated

On 4.x, the newest line:

npm install js-yaml@4.1.1
Every release on a timeline
5.x

  1. Not affected

    5.0.0 – 5.5.0

    12 releases, latest

4.x

  1. Affected

    4.0.0 – 4.1.0

    2 releases

  2. Fixed

    4.1.1 – 4.3.2

    5 releases

3.x

  1. Affected

    3.0.0 – 3.14.1

    46 releases

  2. Fixed

    3.14.2 – 3.15.2

    4 releases

2.x

  1. Affected

    2.0.0 – 2.1.3

    10 releases

1.x

  1. Affected

    1.0.0 – 1.0.3

    4 releases

0.x

  1. Affected

    0.2.0 – 0.3.7

    11 releases

94 stable releases of js-yaml, oldest to newest, one row per major.

What happens

Impact

In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.

Patches

Problem is patched in js-yaml 4.1.1 and 3.14.2.

Workarounds

You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

References

cheatsheetseries.owasp.org/cheatsheets/Prototyp…