js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 2.0.4 to 2.1.3
5 releases in betweennotes for 0
- ?
- changes to make
- 1
- advisory fixed
- ?
- new
- ?
- fixes
Counted from 0 of 5 release notes. Advisories are counted from the advisory database, in full.
Security
4 advisories still affect 2.1.3
- js-yaml has prototype pollution in merge (<<)moderate · GHSA-mh29-5h37-fv8m
- Denial of Service in js-yamlmoderate · GHSA-2pr6-76vf-7546
- Code Injection in js-yamlhigh · GHSA-8j8c-7jfh-h6hx
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesmoderate · GHSA-h67p-54hq-rp68
Upgrading to 3.15.0 clears them.
Fixes 1 advisory affecting 2.0.4
- Deserialization Code Execution in js-yamlcritical · GHSA-xxvw-45rp-3mj2