Multiple vulnerabilities have been identified in the js-yaml library, involving quadratic-complexity Denial of Service (DoS) flaws triggered by crafted YAML documents using merge-key chains or the !!omap tag. Attackers can exploit these issues to cause excessive CPU consumption and stall application event loops by submitting malicious input to the parser. Successful exploitation could degrade application availability and disrupt critical services.
CVE-2026-59870 (CVSS 5.3 — Medium): js-yaml introduces YAML11_SCHEMA support with the !!omap tag, which performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses yaml.load with {schema: yaml.YAML11_SCHEMA }.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in the js-yaml library, involving quadratic-complexity Denial of Service (DoS) flaws triggered by crafted YAML documents using merge-key chains or the !!omap tag. Attackers can exploit these issues to cause excessive CPU consumption and stall application event loops by submitting malicious input to the parser. Successful exploitation could degrade application availability and disrupt critical services.
CVE-2026-59870 (CVSS 5.3 — Medium): js-yaml introduces YAML11_SCHEMA support with the !!omap tag, which performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses yaml.load with {schema: yaml.YAML11_SCHEMA }.[emaillocker id="1283"]
CVE-2026-59869 (CVSS 7.5 — High): js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly due to a chain of mappings where each mapping merges the previous one. The issue is triggered by a chain of mappings where each mapping merges the previous one. These vulnerabilities collectively present a significant risk for applications that parse untrusted YAML using js-yaml.
CVE-2026-59868 (CVSS 5.3 — Medium): A denial-of-service vulnerability in js-yaml allows attackers to trigger quadratic CPU consumption by providing specially crafted YAML documents with chained merge keys, causing excessive parsing delays and resource exhaustion.
We recommend you to update js-yaml to below version: https://github.com/nodeca/js-yaml/tags
The following reports contain further technical details:
[/emaillocker]