Security: js-yaml prototype pollution and quadratic-complexity DoS — update to >=4.2.1

[LucasMaupin]

Summary

The backend lockfile includes two vulnerable versions of js-yaml:

• js-yaml@3.14.1 — prototype pollution via YAML merge key (<<) operator
• js-yaml@4.1.0 — quadratic-complexity DoS via documents with repeated YAML aliases

Vulnerability Details

Prototype Pollution (js-yaml <=3.14.2 and 4.0.0–4.2.0)

• CVSS: 5.3 (Medium-High)
• Type: Prototype Pollution via << merge key
• Impact: Attacker who can supply YAML input can pollute Object.prototype, affecting all objects in the process

Quadratic DoS (js-yaml 4.0.0–4.2.0)

• CVSS: 5.3 (Medium)
• Type: Algorithmic complexity / ReDoS
• Impact: Crafted YAML with repeated aliases causes quadratic parse time, enabling DoS

Risk

• If any route accepts YAML input (directly or indirectly), prototype pollution could corrupt server state
• YAML parsing of configuration files at startup is also a vector if supplied externally
• DoS risk for any YAML parsing on user-controlled input

Recommendation

Update all js-yaml usage to >=4.2.1:

npm install js-yaml@latest
npm audit fix

If js-yaml is only a transitive build-tool dependency, ensure it doesn't appear in the production bundle:

npm ls js-yaml

Related Issues

• Security: High-severity npm vulnerabilities in transitive deps — flatted, lodash, minimatch, picomatch, glob #231 — other transitive dep vulnerabilities (flatted, lodash, minimatch, picomatch, glob)
• Security: Run npm audit fix to address 7 high + 8 moderate dependency vulnerabilities #227 — umbrella npm audit fix issue