Fedora Updates Address js-yaml Prototype Pollution Vulnerability

Fedora has released updates for the nodejs package to address a prototype pollution vulnerability in the js-yaml library, identified as CVE-2025-64718. This vulnerability affects multiple Fedora versions, specifically Fedora 42 and 43, allowing potential attackers to exploit the js-yaml library through improper handling of input. The vulnerability was published on November 13, 2025, and has been linked to issues in the yarnpkg package. Users are advised to apply the updates using the 'dnf' update program to mitigate risks. The updates were made available on March 7, 2026, by Sandro Mani. This incident highlights the importance of timely patching to secure dependency management systems. The updates can be installed with specific commands provided in the advisory.

Key Points: • CVE-2025-64718 affects js-yaml in Fedora 42 and 43 due to prototype pollution. • Patches were released on March 7, 2026, and users are urged to update immediately. • The vulnerability was published on November 13, 2025, indicating a known risk.