CVE-2025-64718: js-yaml before 3.14.2 (exclusive), from 4.0.0 (inclusive), before 4.1.1 (exclusive), >= 4.0.0, < 4.1.1, < 3.14.2

Affected technology

js-yaml · before 3.14.2 (exclusive)
nodeca

js-yaml · from 4.0.0 (inclusive), before 4.1.1 (exclusive)
nodeca

js-yaml · >= 4.0.0, < 4.1.1, < 3.14.2
nodeca

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default). Vendor/CNA’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low.