Is js-yaml 5.0 vulnerable?
npm · 1 release from 5.0.0 to 5.0.0 · latest js-yaml is 5.5.0 · checked 1 Nov 2026
Yes: 4 known advisories
Yes. js-yaml 5.0.0, the last 5.0 release, is affected by 4 known security advisories (1 high, 3 medium), including CVE-2026-73643, CVE-2026-59868, CVE-2026-59870. Upgrade to 5.4.1 or later to fix all of them.
npm install js-yaml@5.4.1Advisories affecting js-yaml 5.0.0
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
- Affected
- >=5.0.0 <5.4.1
- Fixed in
- 5.4.1
js-yaml: Exponential parsing time in flow collections leads to denial of service
- Affected
- >=5.0.0 <5.2.2
- Fixed in
- 5.2.2
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
- Affected
- >=5.0.0 <5.2.0
- Fixed in
- 5.2.0
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
- Affected
- >=5.0.0 <5.2.1
- Fixed in
- 5.2.1
Which of your client projects are still on js-yaml 5.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact js-yaml version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other js-yaml versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.