What’s Vulnerable › Vulnerabilities

CVE-2025-64718: js-yaml has prototype pollution in merge (<<)

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-13 · updated 2026-10-07
• Weakness: CWE-1321

Description

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).

Affected products

• nodeca js-yaml: before 3.14.2; from 4.0.0 before 4.1.1 — fixed in 3.14.2, 4.1.1
• Npm Js-Yaml: from 4.0.0 before 4.1.1; before 3.14.2 — fixed in 4.1.1, 3.14.2

How to fix

Upgrade to a fixed version: nodeca js-yaml 3.14.2, 4.1.1; Npm Js-Yaml 4.1.1, 3.14.2. Check the vendor advisory for mitigations.

References

• https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
• https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266
• https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m
• https://github.com/advisories/GHSA-mh29-5h37-fv8m

Get alerted when CVE-2025-64718 or the next vulnerability affects your stack