Back Linuxsecurity

Fedora 44 yarnpkg Update Vendor Bundle Advisory FEDORA-2026

Linuxsecurity •LinuxSecurity Advisories • March 17, 2026

Share: View original

Fast, reliable, and secure dependency management. Update Information : Update vendor bundle.

Fast, reliable, and secure dependency management.

Update vendor bundle.

* Sat Mar 7 2026 Sandro Mani - 1.22.22-17 - Refresh vendor bundle

[ 1 ] Bug #2422491 - CVE-2025-64718 yarnpkg: js-yaml prototype pollution in merge [fedora-42] [ 2 ] Bug #2422506 - CVE-2025-64718 yarnpkg: js-yaml prototype pollution in merge [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-db0c5d039c' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Updates Address js-yaml Prototype Pollution Vulnerability Fedora has released updates for the nodejs package to address a prototype pollution vulnerability in the js-yaml library, identified as CVE-2025-64718. This vulnerability affects multiple Fedora versions, specifically Fedora 42 and 43, allowing potential attackers to exploit the js-yaml library through improper handling of input. The vulnerability was published on November 13, 2025, and has been linked to issues in the yarnpkg package. Users are advised to apply the updates using the 'dnf' update program to mitigate risks. The updates were made available on March 7, 2026, by Sandro Mani. This incident highlights the importance of timely patching to secure dependency management systems. The updates can be installed with specific commands provided in the advisory. 2 sources 58

Extracted Entities

CVEs (1)

CVE-2025-64718