js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Your version
3.9.1
30 Jul 20173.15.2 is the newest release of 3.x.
Security
7 advisories affect 3.9.1; 3.15.2 fixes them
- Highjs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-2883-xcg3-v3hh · 8 Sep 2026Fixed in 3.15.2
- HighJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backportedGHSA-5p4m-2wfm-xmqj · 6 Aug 2026Fixed in 3.15.1
- Highjs-yaml: YAML merge-key chains can force quadratic CPU consumptionGHSA-52cp-r559-cp3m · 20 Jul 2026Fixed in 3.15.0
- HighCode Injection in js-yamlGHSA-8j8c-7jfh-h6hx · 4 Jun 2019Fixed in 3.13.1
- ModerateJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesGHSA-h67p-54hq-rp68 · 15 Jun 2026Fixed in 3.15.0
2 more
- Moderatejs-yaml has prototype pollution in merge (<<)GHSA-mh29-5h37-fv8m · 14 Nov 2025Fixed in 3.14.2
- ModerateDenial of Service in js-yamlGHSA-2pr6-76vf-7546 · 5 Jun 2019Fixed in 3.13.0
Release note
No note was found for 3.9.1 on GitHub or in the repository's changelog.