Denial of Service in js-yaml
Summary
GHSA-2pr6-76vf-7546: Denial of Service in js-yaml. Affects js-yaml versions < 3.13.0. Fixed in 3.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The js-yaml package is an open-source JavaScript library that allows parsing and serializing YAML files. It is commonly used in Node.js applications for handling YAML data. However, versions prior to 3.13.0 are vulnerable to a Denial of Service (DoS) attack. This means that by parsing a specially crafted YAML file, an attacker can cause the Node.js process to stall and potentially exhaust system resources, leading to a DoS condition.
Vulnerability Detail
The vulnerability in js-yaml arises from a flaw in the parsing mechanism. When a maliciously crafted YAML file is processed, the parsing process becomes stuck, causing the Node.js process to hang indefinitely. This can result in resource exhaustion and a DoS condition, rendering the affected application unresponsive. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 5.5.0 as of 23 Oct 2026
npm install js-yaml@5.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.0
This is the first release that contains the fix.
npm install js-yaml@3.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the js-yaml package versions prior to 3.13.0 are vulnerable to a Denial of Service attack. To mitigate this vulnerability, it is crucial to upgrade to version 3.13.0 or higher. This will ensure the necessary patches are applied to prevent the parsing process from stalling and causing a DoS condition. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for js-yaml →
FAQ
The vulnerability can lead to a Denial of Service condition, causing the affected application to become unresponsive and potentially impacting its availability.
At the moment, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the js-yaml package.
No, only versions prior to 3.13.0 are vulnerable. It is crucial to update to version 3.13.0 or higher to mitigate the risk.
Yes, this vulnerability can be exploited remotely by providing a specially crafted YAML file to the affected application.
There is no known instance of this vulnerability being exploited in the wild. However, it is recommended to apply the necessary updates to prevent any potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for js-yaml.
