CVE-2026-59870
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes excessive CPU consumption when parsing a crafted YAML document with the !!omap tag. The omapTag.addItem() function performs a linear duplicate-key scan on every insertion, resulting in O(n^2) computational complexity.
Risk Assessment
An attacker can send a specially crafted YAML document, causing significant CPU load on the server (DoS attack), which may lead to application slowdown or denial of service.
Recommendation
Immediately update the js-yaml library to version 5.2.1 or later, which contains the fix for this vulnerability.
Other vulnerabilities in js-yaml
See all- CVE-2026-73643High
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. Fixed in version 5.2.2.
- CVE-2026-59869High
A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.
- CVE-2026-59868Medium
A vulnerability in the js-yaml library (versions 5.0.0 through 5.2.0) causes quadratic CPU time when parsing YAML documents with merge keys enabled. A chain of mappings where each entry merges the previous one leads to excessive CPU load.
- CVE-2026-53550Medium
A vulnerability in js-yaml (YAML parser for JavaScript) before versions 4.2.0 and 3.15.0 allows a DoS attack via a crafted YAML document that causes quadratic time complexity during merge-key (<<) processing. Repeatedly using the same alias in a merge sequence leads to CPU exhaustion and blocks the Node.js event loop for seconds with a relatively small payload (tens of KB).
Original NVD description (English source)
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.