Is js-yaml 1.0 vulnerable?

npm · 4 releases from 1.0.0 to 1.0.3 · latest js-yaml is 5.5.0 · checked 2 Nov 2026

Yes: 5 known advisories

Yes. js-yaml 1.0.3, the last 1.0 release, is affected by 5 known security advisories (1 critical, 1 high, 3 medium), including CVE-2013-4660, CVE-2026-53550, CVE-2025-64718. Upgrade to 3.15.0 or later to fix all of them.

Upgrade with:npm install js-yaml@3.15.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting js-yaml 1.0.3

  • MediumCVE-2026-53550GHSA-h67p-54hq-rp6815 Jun 2026

    JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

    Affected
    >=4.0.0 <4.2.0 · <3.15.0
    Fixed in
    3.15.0, 4.2.0
  • MediumCVE-2025-64718GHSA-mh29-5h37-fv8m14 Nov 2025

    js-yaml has prototype pollution in merge (<<)

    Affected
    >=4.0.0 <4.1.1 · <3.14.2
    Fixed in
    3.14.2, 4.1.1
  • MediumGHSA-2pr6-76vf-75465 Jun 2019

    Denial of Service in js-yaml

    Affected
    <3.13.0
    Fixed in
    3.13.0
  • HighGHSA-8j8c-7jfh-h6hx4 Jun 2019

    Code Injection in js-yaml

    Affected
    <3.13.1
    Fixed in
    3.13.1
  • CriticalCVE-2013-4660GHSA-xxvw-45rp-3mj224 Oct 2017

    Deserialization Code Execution in js-yaml

    Affected
    <2.0.5
    Fixed in
    2.0.5

Which of your client projects are still on js-yaml 1.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact js-yaml version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other js-yaml versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.