js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 5.5.0 | Safe from 5.4.1 | |
| 4.3.2 | Safe from 4.3.2 | |
| 3.15.2 | Safe from 3.15.2 | |
| 2.1.3 | 19 open advisories, worst critical · last release Oct 2013, no longer updated |
- CriticalDeserialization Code Execution in js-yamlGHSA-xxvw-45rp-3mj2 · 24 Oct 2017fixed in 2.0.5
- Highjs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-2883-xcg3-v3hh · 8 Sep 2026fixed in 4.3.2, 3.15.2
- HighJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backportedGHSA-5p4m-2wfm-xmqj · 6 Aug 2026fixed in 4.3.1, 3.15.1
- Highjs-yaml: Exponential parsing time in flow collections leads to denial of serviceGHSA-pm4m-ph32-ghv5 · 24 Jul 2026fixed in 5.2.2
- Highjs-yaml: YAML merge-key chains can force quadratic CPU consumptionGHSA-52cp-r559-cp3m · 20 Jul 2026fixed in 4.3.0, 3.15.0
- HighCode Injection in js-yamlGHSA-8j8c-7jfh-h6hx · 4 Jun 2019fixed in 3.13.1
- Moderatejs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026fixed in 5.4.1
- Moderatejs-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlGHSA-g796-fgmg-93mv · 20 Jul 2026fixed in 5.2.0
- Moderatejs-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAGHSA-724g-mxrg-4qvm · 20 Jul 2026fixed in 5.2.1
- ModerateJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesGHSA-h67p-54hq-rp68 · 15 Jun 2026fixed in 4.2.0, 3.15.0
- Moderatejs-yaml has prototype pollution in merge (<<)GHSA-mh29-5h37-fv8m · 14 Nov 2025fixed in 4.1.1, 3.14.2
- ModerateDenial of Service in js-yamlGHSA-2pr6-76vf-7546 · 5 Jun 2019fixed in 3.13.0
Registry facts last checked 29 Oct 2026. Releases and advisories last read 29 Oct 2026.