Disclosure summary
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
Source-reported weakness categories
CWE-1321
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-64718
Open original source · Updated Oct 07, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| nodeca | js-yaml | * {"versionStartIncluding":"4.0.0","versionEndExcluding":"4.1.1"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch
- github.com — Issue Tracking
- github.com — Vendor Advisory
- github.com — Vendor Advisory
PUBLISHED 2025-11-13T11:15:57-05:00
MODIFIED 2026-10-07T17:10:00-04:00
INGESTED 2026-10-08T12:35:23-04:00