yaml

2.9.1 · 11 Sept 2026ISC133.3M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Line	Newest	Where it stands
	2.9.1	Safe from 2.8.3
	1.10.3	Safe from 1.10.3

Your version

High
Uncaught Exception in yamlGHSA-f9xv-q969-pqx4 · 24 Apr 2023
- 2.x2.0.0 – 2.2.1Fixed in 2.2.2
Moderate
yaml is vulnerable to Stack Overflow via deeply nested YAML collectionsGHSA-48c2-rrv3-qjmp · 25 Mar 2026
- 2.x2.0.0 – 2.8.2Fixed in 2.8.3
- 1.x1.0.0 – 1.10.2Fixed in 1.10.3

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.