diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2714871..f4ba8a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## [Unreleased]
+
+### Security
+
+- **Resolved js-yaml high-severity advisory CVE-2026-84375** (fixed in js-yaml >= 4.3.2). js-yaml is only a transitive devDependency, pulled on the 4.x line via `cosmiconfig`. Added a scoped npm `override` (`cosmiconfig` → `js-yaml ^4.3.2`) to force the patched line. `npm audit` reports 0 vulnerabilities.
+
 # [1.1.0](https://github.com/WYRE-AI/node-halopsa/compare/v1.0.13...v1.1.0) (2026-09-04)
 
 
diff --git a/package-lock.json b/package-lock.json
index fc1cf02..839f170 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4696,9 +4696,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 36ebf97..386ae41 100644
--- a/package.json
+++ b/package.json
@@ -75,5 +75,10 @@
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.9"
+  },
+  "overrides": {
+    "cosmiconfig": {
+      "js-yaml": "^4.3.2"
+    }
   }
 }