npmPackage

js-yaml

8 known vulnerabilities (4 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 5.5.0 (Oct 15, 2026): no advisory affects it
Newest unaffected release: 5.5.0 (Oct 15, 2026), the latest release
Advisories: 8 · 4 high, 3 medium

Weekly downloads: 389.5M
Dependents: 8,526
Releases: 93 since 0.2.0 (Nov 2, 2011)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-84375
Affects 3.0.0 to 3.15.1 (3.15.2 is outside it); 4.0.0 to 4.3.1 (4.3.2 is outside it)
CVE-2026-73643
Affects 5.0.0 to 5.2.1 (5.2.2 is outside it)
CVE-2026-59868
Affects 5.0.0 to 5.1.0 (5.2.0 is outside it)
CVE-2026-59869
Affects 3.0.0 to 3.14.2 (3.15.0 is outside it); 4.0.0 to 4.2.0 (4.3.0 is outside it)
CVE-2026-59870
Affects 5.0.0 to 5.2.0 (5.2.1 is outside it)
CVE-2026-53550
Affects 0.2.0 to 3.14.2 (3.15.0 is outside it); 4.0.0 to 4.1.1 (4.2.0 is outside it)
CVE-2025-64718
Affects 0.2.0 to 3.14.1 (3.14.2 is outside it); 4.0.0 to 4.1.0 (4.1.1 is outside it)
CVE-2013-4660
Affects 0.2.0 to 2.0.4 (2.0.5 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-84375High 7.5
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Affected: from 4.0.0, fixed in 4.3.2; from 3.0.0, fixed in 3.15.2.
Fixed in 3.15.2 (released Aug 26, 2026, 6 days before disclosure) and 4.3.2 (released Aug 26, 2026, 6 days before disclosure).
The latest release, 5.5.0, is not affected.
52% of js-yaml downloads last week were affected versions (226.1M).
CVE-2026-73643High 7.5
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Affected: from 5.0.0, fixed in 5.2.2.
Fixed in 5.2.2 (released Jul 23, 2026, 21 days before disclosure).
The latest release, 5.5.0, is not affected.
0.2% of js-yaml downloads last week were affected versions (923.9K).
CVE-2026-59868Medium 5.3
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Affected: from 5.0.0, fixed in 5.2.0.
Fixed in 5.2.0 (released Jun 26, 2026, 12 days before disclosure).
The latest release, 5.5.0, is not affected.
<0.1% of js-yaml downloads last week were affected versions (26.8K).
CVE-2026-59869High 7.5
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Affected: from 3.0.0, fixed in 3.15.0; from 4.0.0, fixed in 4.3.0.
Fixed in 3.15.0 (released Jun 26, 2026, 12 days before disclosure) and 4.3.0 (released Jun 26, 2026, 12 days before disclosure).
The latest release, 5.5.0, is not affected.
43% of js-yaml downloads last week were affected versions (186.5M).
CVE-2026-59870High 7.5
js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
Affected: from 5.0.0, fixed in 5.2.1.
Fixed in 5.2.1 (released Jul 2, 2026, 6 days before disclosure).
The latest release, 5.5.0, is not affected.
<0.1% of js-yaml downloads last week were affected versions (252K).
CVE-2026-53550Medium 5.3
js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Affected: from 4.0.0, fixed in 4.2.0; fixed in 3.15.0.
Fixed in 3.15.0 (released Jun 26, 2026, 4 days after disclosure) and 4.2.0 (released May 31, 2026, 22 days before disclosure).
The latest release, 5.5.0, is not affected.
40% of js-yaml downloads last week were affected versions (175.8M).
CVE-2025-64718Medium 5.3
js-yaml has prototype pollution in merge (<<)
Affected: from 4.0.0, fixed in 4.1.1; fixed in 3.14.2.
Fixed in 3.14.2 (released Nov 14, 2025, 1 day after disclosure) and 4.1.1 (released Nov 12, 2025, 1 day before disclosure).
The latest release, 5.5.0, is not affected.
24% of js-yaml downloads last week were affected versions (105.6M).
CVE-2013-4660Unrated
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote…
Affected: fixed in 2.0.5.
Fixed in 2.0.5 (released Apr 26, 2013, 63 days before disclosure).
The latest release, 5.5.0, is not affected.
<0.1% of js-yaml downloads last week were affected versions (58.6K).