npm/js-yaml: medium 5.3

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Action: Upgrade js-yaml to 5.4.1 or later.

npm i js-yaml@5.4.1

Affected

Fixed versions

Sources

• osv: GHSA-r3ph-w7gj-g6xm
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-r3ph-w7gj-g6xm
• https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480
• https://github.com/nodeca/js-yaml
• https://github.com/nodeca/js-yaml/releases/tag/5.4.1

published 2026-09-29T17:57:39Z · modified 2026-09-29T18:15:05.565309337Z · JSON