js-yaml

5.5.0 · 15 Oct 2026MIT322.7M / weekRepository Homepage npm Atom feed

Your version

5.2.0

26 Jun 2026Where it was published

5.5.0 is the newest release of 5.x.

In short

1 breaking2 new1 fixed

breaking
maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Security

Fixes 1 advisory that affected 5.1.0

Moderate
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlGHSA-g796-fgmg-93mv · 20 Jul 2026
Fixed in 5.2.0

3 advisories affect 5.2.0; 5.4.1 fixes them

High
js-yaml: Exponential parsing time in flow collections leads to denial of serviceGHSA-pm4m-ph32-ghv5 · 24 Jul 2026
Fixed in 5.2.2
Moderate
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026
Fixed in 5.4.1
Moderate
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAGHSA-724g-mxrg-4qvm · 20 Jul 2026
Fixed in 5.2.1

Release note

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of
keys processed by YAML merge (<<) across one load() / loadAll() call.
Added maxAliases (-1) loader option to limit the number of YAML aliases per
document.

Removed

breaking
maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge
processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)