What is the CVSS score of CVE-2026-59868?

CVE-2026-59868 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of js-yaml are affected by CVE-2026-59868?

js-yaml, a widely deployed Node.js library for parsing YAML configuration and data files, contains a denial-of-service vulnerability (CVE-2026-59868) in versions 5.0.0 through 5.1.x that allows…. A patch is available.

Is there a public PoC exploit available for CVE-2026-59868?

Yes, a public proof-of-concept exploit is available for CVE-2026-59868. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59868?

Within 24 hours, identify all applications and services running js-yaml and confirm which use affected versions 5.0.0 through 5.1.x; assess exposure severity based on whether those applications accept untrusted YAML input. Within 7 days, upgrade all affected instances to js-yaml version 5.2.0 or later across all environments including development, staging, and production. Within 30 days, verify complete deployment of the patched version, audit dependency lock files to prevent regression, and establish monitoring for exploitation attempts.

js-yaml CVE-2026-59868

EUVD-2026-42302 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-07-08 GitHub_M

GHSA-g796-fgmg-93mv

Information Disclosure Red Hat Js Yaml Nodeca

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Attacker sends a crafted document over the network with no auth or interaction (AV:N/PR:N/UI:N); only availability is hit via CPU exhaustion (A:H, C/I:N), and the merge-key precondition is a deployment setting, not attacker effort, so AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 15:14 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 13, 2026 - 15:13 vuln.today

Analysis Updated

Jul 13, 2026 - 15:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 15:07 vuln.today

cvss_changed

Severity Changed

Jul 13, 2026 - 15:07 NVD

MEDIUM HIGH

CVSS changed

Jul 13, 2026 - 15:07 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Patch available

Jul 08, 2026 - 17:01 EUVD

Analysis Generated

Jul 08, 2026 - 16:44 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 npm packages depend on js-yaml (7 direct, 2 indirect)

Ecosystem-wide dependent count for version 5.0.0.

DescriptionNVD

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

AnalysisAI

Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attacker consume quadratic CPU time by submitting a small, linearly-sized YAML document that chains merge keys (<<) so each mapping merges the previous one. Because confidentiality and integrity impact are nil and only availability is affected (CVSS 7.5, AV:N/A:H), a single crafted document can stall or hang the parsing thread. SSVC rates this poc / automatable=yes / partial impact; there is no public weaponized exploit and it is not on CISA KEV, with a low EPSS of 0.29%.

Technical ContextAI

js-yaml (published under vendor 'nodeca', CPE cpe:2.3:a:nodeca:js-yaml) is one of the most widely used JavaScript YAML parsers, invoked whenever an application calls load()/loadAll() on YAML input. The flaw is a CWE-407 Inefficient Algorithmic Complexity issue in how the merge key (<<) feature folds one mapping's keys into another: when a chain of mappings each merges the prior mapping (a0 into a1, a1 into a2, and so on), the total number of keys the constructor must process grows quadratically relative to the document's linear source size, producing an algorithmic-complexity DoS. The upstream fix commit (3105455b) confirms the root cause and remedy - the old maxMergeSeqLength cap is replaced with a new maxTotalMergeKeys loader option (default 10000) that bounds the total keys processed by merge across a single load()/loadAll() call and throws a YAMLException once exceeded.

RemediationAI

Vendor-released patch: upgrade js-yaml to 5.2.0 or later, which fixes the quadratic merge-key behavior and adds the maxTotalMergeKeys loader option (default 10000) to bound merge processing (release: https://github.com/nodeca/js-yaml/releases/tag/5.2.0; advisory: https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv). If you cannot upgrade immediately, the most effective compensating control is to avoid enabling merge keys when parsing untrusted YAML - load with the default schema instead of a YAML 1.1 / merge-enabled schema, which removes the attack surface entirely at the cost of losing << merge support. Additional layered controls include enforcing strict input-size limits on YAML from untrusted sources and running parsing under a CPU/time budget (for example a worker thread with a timeout, as the project's own pathological test does) so one document cannot hang the main event loop; the trade-off is added complexity and rejecting legitimately large documents. After upgrading, applications that legitimately use merges can tune maxTotalMergeKeys to a lower value for stricter protection.