js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Your version
5.5.0 is the newest release of 5.x.
In short
1 security1 fixed
Security
Fixes 1 advisory that affected 5.2.1
- Highjs-yaml: Exponential parsing time in flow collections leads to denial of serviceGHSA-pm4m-ph32-ghv5 · 24 Jul 2026Fixed in 5.2.2
1 advisory affects 5.2.2; 5.4.1 fixes them
- Moderatejs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026Fixed in 5.4.1
Release note
Fixed
Quote flow scalars where a colon precedes a flow indicator, #773.
Security
- security
Avoid exponential parsing time for nested flow sequence pairs.