js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 4.1.1 to 4.3.2
4 releases in betweennotes for 0
Other targets from 4.1.1Latest5.5.0
- ?
- changes to make
- 4
- advisories fixed
- ?
- new
- ?
- fixes
Counted from 0 of 4 release notes. Advisories are counted from the advisory database, in full.
Security
Fixes 4 advisories affecting 4.1.1
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourceshigh · GHSA-2883-xcg3-v3hh
- js-yaml: YAML merge-key chains can force quadratic CPU consumptionhigh · GHSA-52cp-r559-cp3m
- JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backportedhigh · GHSA-5p4m-2wfm-xmqj
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesmoderate · GHSA-h67p-54hq-rp68