MediumGHSA-mh29-5h37-fv8mCVE-2025-64718

js-yaml has prototype pollution in merge (<<)

Published 14 Nov 2025 · Updated 10 Sept 2026

Affected packages

js-yamlnpm
Affected
>=4.0.0 <4.1.1
Fixed in
4.1.1
Update to the fixed version for your release line, for example:npm install js-yaml@4.1.1
js-yamlnpm
Affected
<3.14.2
Fixed in
3.14.2
Update to the fixed version for your release line, for example:npm install js-yaml@3.14.2

Details

Impact

In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.

Patches

Problem is patched in js-yaml 4.1.1 and 3.14.2.

Workarounds

You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default).

References

https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

Is GHSA-mh29-5h37-fv8m in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected js-yaml, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.