Is js-yaml 5.2 vulnerable?
npm · 4 releases from 5.2.0 to 5.2.3 · latest js-yaml is 5.5.0 · checked 1 Nov 2026
Yes: 1 known advisory
Yes. js-yaml 5.2.3, the last 5.2 release, is affected by 1 known security advisory (1 medium). 2 more affect earlier 5.2.x releases. Upgrade to 5.4.1 or later to fix all of them.
npm install js-yaml@5.4.1Advisories affecting js-yaml 5.2.3
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
- Affected
- >=5.0.0 <5.4.1
- Fixed in
- 5.4.1
Fixed within 5.2.x, affecting earlier releases
js-yaml: Exponential parsing time in flow collections leads to denial of service
- Affected
- >=5.0.0 <5.2.2
- Fixed in
- 5.2.2
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
- Affected
- >=5.0.0 <5.2.1
- Fixed in
- 5.2.1
Which of your client projects are still on js-yaml 5.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact js-yaml version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other js-yaml versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.