js-yaml (npm)
JavaScript YAML parser and dumper. Very fast.
Advisories
31
Latest version
5.5.0
Released Oct 15, 2026
License
MIT
OpenSSF Scorecard
6.0 / 10
How to fix
Upgrading to 5.4.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install js-yaml@5.5.0yarn
yarn add js-yaml@5.5.0pnpm
pnpm add js-yaml@5.5.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r3ph-w7gj-g6xm js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
Medium | >= 5.0.0, <= 5.4.0 | No fix yet |
| GHSA-r3ph-w7gj-g6xm js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
Medium | >= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
High EPSS 0.54% |
>= 4.0.0, < 4.3.2 | 4.3.2 |
| GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
High EPSS 0.54% |
>= 3.0.0, < 3.15.2 | 3.15.2 |
| GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
High EPSS 0.54% |
>= 3.0.0, < 3.15.2 | 3.15.2 |
| GHSA-2883-xcg3-v3hh js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
High EPSS 0.54% |
>= 4.0.0, < 4.3.2 | 4.3.2 |
| GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported |
High | >= 4.0.0, < 4.3.1 | 4.3.1 |
| GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported |
High | >= 4.0.0, < 4.3.1 | 4.3.1 |
| GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported |
High | >= 3.0.0, < 3.15.1 | 3.15.1 |
| GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported |
High | >= 3.0.0, < 3.15.1 | 3.15.1 |
| GHSA-pm4m-ph32-ghv5 js-yaml: Exponential parsing time in flow collections leads to denial of service |
High EPSS 0.49% |
>= 5.0.0, <= 5.2.1 | No fix yet |
| GHSA-pm4m-ph32-ghv5 js-yaml: Exponential parsing time in flow collections leads to denial of service |
High EPSS 0.49% |
>= 5.0.0, < 5.2.2 | 5.2.2 |
| GHSA-724g-mxrg-4qvm js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA |
High EPSS 0.74% |
>= 5.0.0, < 5.2.1 | 5.2.1 |
| GHSA-724g-mxrg-4qvm js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA |
High EPSS 0.74% |
>= 5.0.0, <= 5.2.0 | No fix yet |
| GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption |
High EPSS 0.58% |
>= 4.0.0, < 4.3.0 | 4.3.0 |
| GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption |
High EPSS 0.58% |
>= 3.0.0, < 3.15.0 | 3.15.0 |
| GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption |
High EPSS 0.58% |
>= 4.0.0, < 4.3.0 | 4.3.0 |
| GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption |
High EPSS 0.58% |
>= 3.0.0, < 3.15.0 | 3.15.0 |
| GHSA-g796-fgmg-93mv js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml |
High EPSS 0.64% |
>= 5.0.0, < 5.2.0 | 5.2.0 |
| GHSA-g796-fgmg-93mv js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml |
High EPSS 0.64% |
>= 5.0.0, <= 5.1.0 | No fix yet |
| GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases |
Medium EPSS 0.41% |
>= 4.0.0, <= 4.1.1 | No fix yet |
| GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases |
Medium EPSS 0.41% |
< 3.15.0 | 3.15.0 |
| GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases |
Medium EPSS 0.41% |
>= 4.0.0, < 4.2.0 | 4.2.0 |
| GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases |
Medium EPSS 0.41% |
< 3.15.0 | 3.15.0 |
| GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) |
Medium EPSS 0.42% |
< 3.14.2 | 3.14.2 |
| GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) |
Medium EPSS 0.42% |
>= 4.0.0, < 4.1.1 | 4.1.1 |
| GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) |
Medium EPSS 0.42% |
< 3.14.2 | 3.14.2 |
| GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<) |
Medium EPSS 0.42% |
>= 4.0.0, < 4.1.1 | 4.1.1 |
| GHSA-2pr6-76vf-7546 Denial of Service in js-yaml |
Medium | < 3.13.0 | 3.13.0 |
| GHSA-8j8c-7jfh-h6hx Code Injection in js-yaml |
High | < 3.13.1 | 3.13.1 |
| GHSA-xxvw-45rp-3mj2 Deserialization Code Execution in js-yaml |
Critical EPSS 17.32% |
< 2.0.5 | 2.0.5 |
Source: git+https://github.com/nodeca/js-yaml.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor