CVE-2026-59868
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes quadratic CPU time when parsing YAML documents with merge keys enabled. A chain of mappings where each entry merges the previous one leads to excessive CPU load.
Risk Assessment
An attacker can send a specially crafted YAML document that slows down the server or application, leading to denial of service (DoS) due to CPU resource exhaustion.
Recommendation
Immediately update the js-yaml library to version 5.2.0 or later, which includes a fix that eliminates the quadratic processing time issue.
Other vulnerabilities in js-yaml
See all- CVE-2026-73643High
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. Fixed in version 5.2.2.
- CVE-2026-59870Medium
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes excessive CPU consumption when parsing a crafted YAML document with the !!omap tag. The omapTag.addItem() function performs a linear duplicate-key scan on every insertion, resulting in O(n^2) computational complexity.
- CVE-2026-59869High
A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.
- CVE-2026-53550Medium
A vulnerability in js-yaml (YAML parser for JavaScript) before versions 4.2.0 and 3.15.0 allows a DoS attack via a crafted YAML document that causes quadratic time complexity during merge-key (<<) processing. Repeatedly using the same alias in a merge sequence leads to CPU exhaustion and blocks the Node.js event loop for seconds with a relatively small payload (tens of KB).
Original NVD description (English source)
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.