Description
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nodeca | js-yaml | >= 4.0.0, < 4.1.1, < 3.14.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-js-yaml | 4.1.1+dfsg+~4.0.9-1 | — |
| Debian 13 | node-js-yaml | No fix yet | — |
| Debian 12 | node-js-yaml | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-js-yaml | No fix yet | — |
| Ubuntu 26.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 25.10 | node-js-yaml | No fix yet | — |
| Ubuntu 24.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 22.04 LTS | node-js-yaml | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-js-yaml | No fix yet | — |
| Ubuntu 18.04 LTS | node-js-yaml | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cockpit-repos | 4.7-160000.1.1 | SUSE-SU-2026:20580-1 |
| SLES for SAP 16.0 | cockpit-subscriptions | 12.1-160000.1.1 | SUSE-SU-2026:20182-1 |
| SLES 16.0 | cockpit-repos | 4.7-160000.1.1 | SUSE-SU-2026:20580-1 |
| SLES 16.0 | cockpit-subscriptions | 12.1-160000.1.1 | SUSE-SU-2026:20182-1 |
| SLE Micro 6.2 | cockpit-repos | 4.7-160000.1.1 | SUSE-SU-2026:20540-1 |
| SLE Micro 6.2 | cockpit-subscriptions | 12.1-160000.1.1 | SUSE-SU-2026:20170-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cockpit-repos | 4.6-1.1 | openSUSE-SU-2026:10036-1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git185.a5708584-2.1 | openSUSE-SU-2026:11126-1 |
| openSUSE Leap 16.0 | cockpit-repos | 4.7-160000.1.1 | openSUSE-SU-2026:20251-1 |
| openSUSE Leap 16.0 | cockpit-subscriptions | 12.1-160000.1.1 | openSUSE-SU-2026:20117-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-3.7 +3 | 3.7.4-r1 | — |
| Wolfi rolling | code-server +1 | 4.106.2-r0 | — |
| Wolfi rolling | eslint | 9.39.1-r1 | — |
| Wolfi rolling | jitsucom-jitsu +1 | 2.11.0-r7 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-pipelines +11 | 2.14.4-r1 | — |
| Wolfi rolling | lerna | 9.0.1-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 +13 | 3.2.0-r1 | — |
| Wolfi rolling | prism | 5.14.3-r1 | — |
| Wolfi rolling | pulumi +3 | 3.209.0-r0 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
| Wolfi rolling | renovate | 42.26.0-r0 | — |
| Wolfi rolling | saf | 1.5.2-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r28 | — |
| Wolfi rolling | thingsboard +4 | 4.2.1-r8 | — |
| Wolfi rolling | tileserver-gl +1 | 5.4.0-r4 | — |
| Wolfi rolling | ts-patch | 4.0.1-r41 | — |
| Wolfi rolling | vitess-23 +2 | 23.0.0-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | js-yaml | >= 4.0.0, < 4.1.1 | 4.1.1 | GHSA-mh29-5h37-fv8m |
| npm | js-yaml | < 3.14.2 | 3.14.2 | GHSA-mh29-5h37-fv8m |
Advisories 16
- openSUSE-SU-2026:11126-1 velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media SUSE / openSUSE Security Updates · Jun 26, 2026
- WID-SEC-2026-0752 IBM SPSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- WID-SEC-2025-2909 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 7, 2026
- openSUSE-SU-2026:20251-1 Security update for cockpit-repos SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:20117-1 Security update for cockpit-subscriptions SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10036-1 cockpit-repos-4.6-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20540-1 Security update for cockpit-repos SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20580-1 Security update for cockpit-repos SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20182-1 Security update for cockpit-subscriptions SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20170-1 Security update for cockpit-subscriptions SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-071-03 Siemens SIDIS Prime CISA ICS & IT advisories · Mar 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026
- SSA-485750 SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 Siemens ProductCERT · Mar 10, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2853 HCL Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 15, 2025
References
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m
- https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876
- https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879
- https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266