js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Your version
5.5.0 is the newest release of 5.x.
In short
1 security1 new
Security
Fixes 1 advisory that affected 5.2.0
- Moderatejs-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAGHSA-724g-mxrg-4qvm · 20 Jul 2026Fixed in 5.2.1
2 advisories affect 5.2.1; 5.4.1 fixes them
- Highjs-yaml: Exponential parsing time in flow collections leads to denial of serviceGHSA-pm4m-ph32-ghv5 · 24 Jul 2026Fixed in 5.2.2
- Moderatejs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026Fixed in 5.4.1
Release note
Fixed
Add
Mapsupport to !!omap (should work whenrealMapTagused)
Security
- security
Remove quadratic complexity from !!omap
addItem. Regression from v5
(usually not critical, because YAML11_SCHEMA is not default anymore).