CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
Attackers can pollute object prototypes when parsing untrusted YAML, potentially leading to code execution or privilege escalation in Node.js applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64718?
CVE-2025-64718 is a medium-severity vulnerability in nodeca js-yaml, published on 13 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
Weakness: CWE-1321
Which versions are affected by CVE-2025-64718?
4 open source packages ship an affected version, including js-yaml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
js-yaml npm | All versions | 3.14.2 |
js-yaml npm | All versions | 3.14.2 |
js-yaml npm | From 4.0.0 | 4.1.1 |
js-yaml npm | From 4.0.0 | 4.1.1 |
Linux distribution packages (5)
cockpit-subscriptions SUSE:Linux Enterprise Server 16.0 | All versions | 12.1-160000.1.1 |
cockpit-subscriptions SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 12.1-160000.1.1 |
cockpit-subscriptions SUSE:Linux Micro 6.2 | All versions | 12.1-160000.1.1 |
cockpit-subscriptions openSUSE:Leap 16.0 | All versions | 12.1-160000.1.1 |
cockpit-repos openSUSE:Tumbleweed | All versions | 4.6-1.1 |
Products include Nodeca Js-Yaml.
How do I fix CVE-2025-64718?
Upgrade js-yaml to a fixed version for your release line: 3.14.2 or 4.1.1.
Is CVE-2025-64718 being exploited?
There is no known exploitation of CVE-2025-64718 in the wild and no public exploit code.
Other vulnerabilities in nodeca js-yaml
- CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
- CVE-2013-4660 Deserialization Code Execution in js-yaml
- CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2026-53550 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Sources
Also known as CLEANSTART-2026-AO87470, CLEANSTART-2026-GV78775, CLSA-2026-1773965915, DEBIAN-CVE-2025-64718, ECHO-5d95-5ad2-512c, GHSA-mh29-5h37-fv8m and 30 more.