Skip to main content

js-yaml CVE-2026-59869

| EUVDEUVD-2026-42301 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-07-08 GitHub_M GHSA-52cp-r559-cp3m
Information Disclosure Js Yaml Red Hat Suse
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Untrusted YAML is parsed remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is pure CPU-exhaustion DoS, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 17:01 EUVD
Analysis Generated
Jul 08, 2026 - 16:20 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on js-yaml (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

AnalysisAI

Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote attackers to consume quadratic CPU time by submitting a linearly-sized YAML document built from a chain of mappings that use merge keys, where each mapping merges the previous one. Exploitation requires no authentication or user interaction (CVSS 7.5, availability-only impact), and any application that parses attacker-controlled YAML with a vulnerable version is affected. No public exploit identified at time of analysis; fixes are available in 3.15.0 and 4.3.0.

Technical ContextAI

js-yaml (npm package by nodeca) is one of the most heavily-depended-upon YAML parsers in the JavaScript/Node.js ecosystem, used directly and transitively across build tools, configuration loaders, and web frameworks. The root cause is CWE-407 (Inefficient Algorithmic Complexity): the YAML merge key feature (the '<<' key defined by the YAML 1.1 merge specification) lets one mapping inherit another mapping's keys. When mappings are chained so that each successive mapping merges the previous one, resolving the merges causes the parser to repeatedly copy/expand the accumulated key set, turning a document that grows linearly in size into O(n²) work. The affected component is cpe:2.3:a:nodeca:js-yaml, all versions in the 3.0.0-3.14.x and 4.0.0-4.2.x ranges.

RemediationAI

Vendor-released patch: upgrade to js-yaml 4.3.0 (for the 4.x line) or 3.15.0 (for applications still on 3.x), which contain the fix (commits 24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 and 59423c6f8cdc78742ac00e25a4dd39ef16b702e4). Because js-yaml is frequently a transitive dependency, audit your dependency tree (npm ls js-yaml) and force resolution/override of nested copies, not just the top-level package. Where immediate upgrade is not possible, compensating controls are to stop parsing untrusted YAML with the vulnerable version, cap the accepted input size before parsing, and/or run parsing under a CPU/time budget or worker thread that can be terminated - with the trade-off that size caps may reject legitimate large documents and timeouts add latency and complexity. Details: https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m.

More in Js Yaml

View all
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2026-84375 HIGH
7.5 Sep 01

Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to
CVE-2026-59868 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attack
CVE-2026-59870 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote att
CVE-2025-64718 MEDIUM
5.3 Nov 13

js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-59094 HIGH POC
8.7
CVE-2026-59887 HIGH POC
7.5
CVE-2026-73643 HIGH POC
7.5
CVE-2024-9631 HIGH POC
7.5
CVE-2026-27903 HIGH POC
7.5
CVE-2026-3988 HIGH POC
7.5
CVE-2026-45186 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-59869 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy