What is the CVSS score of CVE-2026-59870?

CVE-2026-59870 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of js-yaml are affected by CVE-2026-59870?

The js-yaml JavaScript YAML parser (versions 5.0.0-5.2.0) is vulnerable to remote denial-of-service attacks that can crash or degrade services by exhausting server CPU resources.. A patch is available.

Is there a public PoC exploit available for CVE-2026-59870?

Yes, a public proof-of-concept exploit is available for CVE-2026-59870. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59870?

Within 24 hours: Inventory all applications using js-yaml versions 5.0.0-5.2.0 and prioritize those that accept external YAML input. Within 7 days: Upgrade js-yaml to version 5.2.1 or later across all affected systems and validate in staging before production deployment. Within 30 days: Implement input validation and rate limiting on YAML parsing endpoints, and review application logs for exploitation attempts.

js-yaml CVE-2026-59870

EUVD-2026-42300 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-07-08 GitHub_M

GHSA-724g-mxrg-4qvm

Information Disclosure Js Yaml Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Availability-only DoS with no auth (PR:N), but AC:H because exploitation requires the non-default YAML11_SCHEMA to be configured and untrusted YAML parsed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 19:28 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 10, 2026 - 19:28 vuln.today

Analysis Updated

Jul 10, 2026 - 19:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 10, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Jul 10, 2026 - 19:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Patch available

Jul 08, 2026 - 17:01 EUVD

Analysis Generated

Jul 08, 2026 - 16:42 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 npm packages depend on js-yaml (7 direct, 2 indirect)

Ecosystem-wide dependent count for version 5.0.0.

DescriptionNVD

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.

AnalysisAI

Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote attackers to exhaust CPU by submitting a crafted YAML document containing an ordered-map (!!omap) node with many entries. Because the !!omap handler performs a linear duplicate-key scan on every insertion, parsing scales as O(n^2), so a modestly sized payload can consume disproportionate CPU when yaml.load() is called. Exploitation is gated behind the non-default YAML11_SCHEMA; SSVC lists proof-of-concept exploit status, there is no CISA KEV entry, and EPSS is low at 0.29%.

Technical ContextAI

js-yaml is one of the most widely used YAML parsers in the Node.js/JavaScript ecosystem, commonly embedded in build tooling, config loaders, and web backends. The flaw lives in src/tag/sequence/omap.ts, which implements the YAML 1.1 !!omap (ordered map) tag. The pre-fix addItem() appended each map entry to an array and, for every insertion, iterated the entire existing container to detect duplicate keys - an O(n) check per item, yielding O(n^2) total work across n items. This is a textbook instance of CWE-407 (Inefficient Algorithmic Complexity / algorithmic-complexity DoS), where attacker-controlled input size drives quadratic resource growth. The 5.2.1 fix replaces the linear scan with a Set-based (O(1) average) duplicate check via a carrier object holding a seen Set. The affected package is cpe:2.3:a:nodeca:js-yaml, and critically the vulnerable code path is only reachable when the caller explicitly selects YAML11_SCHEMA, since js-yaml no longer uses the YAML 1.1 schema (with !!omap) by default.

RemediationAI

Upgrade js-yaml to version 5.2.1 or later (Vendor-released patch: 5.2.1), which replaces the quadratic duplicate-key scan with an O(1) Set-based check per the fixing commit 39f3211a2f01b3c6982710cf21434ab7060acefe; see the advisory at https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm and release notes at https://github.com/nodeca/js-yaml/releases/tag/5.2.1. If you cannot upgrade immediately, the most effective compensating control is to stop passing schema: YAML11_SCHEMA to load()/yaml.load() and use the default schema, which does not process the !!omap tag and eliminates the vulnerable path entirely - the trade-off is loss of YAML 1.1 !!omap parsing for any legitimate documents that rely on it. Where untrusted YAML must be parsed, additionally enforce strict input size limits and parse within a timeout or worker/child process so a single malicious document cannot pin the main event loop. Run npm audit/update transitive dependencies, since js-yaml is frequently pulled in indirectly.