# js-yaml (npm) vulnerabilities 8 known vulnerabilities (4 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.5.0 (Oct 15, 2026): no advisory affects it - Newest unaffected release: 5.5.0 (Oct 15, 2026), the latest release - Weekly downloads: 389.5M - Dependents: 8,526 - Releases: 93 since 0.2.0 (Nov 2, 2011) - Registry: https://www.npmjs.com/package/js-yaml - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-84375: 3.0.0 to 3.15.1 (3.15.2 is outside it); 4.0.0 to 4.3.1 (4.3.2 is outside it) - CVE-2026-73643: 5.0.0 to 5.2.1 (5.2.2 is outside it) - CVE-2026-59868: 5.0.0 to 5.1.0 (5.2.0 is outside it) - CVE-2026-59869: 3.0.0 to 3.14.2 (3.15.0 is outside it); 4.0.0 to 4.2.0 (4.3.0 is outside it) - CVE-2026-59870: 5.0.0 to 5.2.0 (5.2.1 is outside it) - CVE-2026-53550: 0.2.0 to 3.14.2 (3.15.0 is outside it); 4.0.0 to 4.1.1 (4.2.0 is outside it) - CVE-2025-64718: 0.2.0 to 3.14.1 (3.14.2 is outside it); 4.0.0 to 4.1.0 (4.1.1 is outside it) - CVE-2013-4660: 0.2.0 to 2.0.4 (2.0.5 is outside it) ## Advisories (8) ### [CVE-2026-84375](https://cve.now/CVE-2026-84375): js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - Severity: High 7.5 - Published: Sep 1, 2026 - Affected: from 4.0.0, fixed in 4.3.2; from 3.0.0, fixed in 3.15.2. - Fixed in 3.15.2 (released Aug 26, 2026, 6 days before disclosure) and 4.3.2 (released Aug 26, 2026, 6 days before disclosure). - The latest release, 5.5.0, is not affected. - 52% of js-yaml downloads last week were affected versions (226.1M). ### [CVE-2026-73643](https://cve.now/CVE-2026-73643): js-yaml: Exponential parsing time in the flow collections leads to denial of service - Severity: High 7.5 - Published: Aug 13, 2026 - Affected: from 5.0.0, fixed in 5.2.2. - Fixed in 5.2.2 (released Jul 23, 2026, 21 days before disclosure). - The latest release, 5.5.0, is not affected. - 0.2% of js-yaml downloads last week were affected versions (923.9K). ### [CVE-2026-59868](https://cve.now/CVE-2026-59868): js-yaml: YAML merge-key chains can force quadratic CPU consumption - Severity: Medium 5.3 - Published: Jul 8, 2026 - Affected: from 5.0.0, fixed in 5.2.0. - Fixed in 5.2.0 (released Jun 26, 2026, 12 days before disclosure). - The latest release, 5.5.0, is not affected. - <0.1% of js-yaml downloads last week were affected versions (26.8K). ### [CVE-2026-59869](https://cve.now/CVE-2026-59869): js-yaml: YAML merge-key chains can force quadratic CPU consumption - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: from 3.0.0, fixed in 3.15.0; from 4.0.0, fixed in 4.3.0. - Fixed in 3.15.0 (released Jun 26, 2026, 12 days before disclosure) and 4.3.0 (released Jun 26, 2026, 12 days before disclosure). - The latest release, 5.5.0, is not affected. - 43% of js-yaml downloads last week were affected versions (186.5M). ### [CVE-2026-59870](https://cve.now/CVE-2026-59870): js-yaml quadratic-complexity denial of service via YAML11\_SCHEMA !!omap parsing - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: from 5.0.0, fixed in 5.2.1. - Fixed in 5.2.1 (released Jul 2, 2026, 6 days before disclosure). - The latest release, 5.5.0, is not affected. - <0.1% of js-yaml downloads last week were affected versions (252K). ### [CVE-2026-53550](https://cve.now/CVE-2026-53550): js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: from 4.0.0, fixed in 4.2.0; fixed in 3.15.0. - Fixed in 3.15.0 (released Jun 26, 2026, 4 days after disclosure) and 4.2.0 (released May 31, 2026, 22 days before disclosure). - The latest release, 5.5.0, is not affected. - 40% of js-yaml downloads last week were affected versions (175.8M). ### [CVE-2025-64718](https://cve.now/CVE-2025-64718): js-yaml has prototype pollution in merge (\<\<) - Severity: Medium 5.3 - Published: Nov 13, 2025 - Affected: from 4.0.0, fixed in 4.1.1; fixed in 3.14.2. - Fixed in 3.14.2 (released Nov 14, 2025, 1 day after disclosure) and 4.1.1 (released Nov 12, 2025, 1 day before disclosure). - The latest release, 5.5.0, is not affected. - 24% of js-yaml downloads last week were affected versions (105.6M). ### [CVE-2013-4660](https://cve.now/CVE-2013-4660): The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote… - Severity: Unrated - Published: Jun 28, 2013 - Affected: fixed in 2.0.5. - Fixed in 2.0.5 (released Apr 26, 2013, 63 days before disclosure). - The latest release, 5.5.0, is not affected. - <0.1% of js-yaml downloads last week were affected versions (58.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/js-yaml Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.