Skip to main content

js-yaml EUVDEUVD-2026-42301

| CVE-2026-59869 HIGH
Inefficient Algorithmic Complexity (CWE-407)
2026-07-08 GitHub_M GHSA-52cp-r559-cp3m
Information Disclosure Js Yaml Nodeca
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify endpoint parsing user YAML
  2. Delivery
    Craft merge-key mapping chain
  3. Exploit
    Submit linearly-sized payload
  4. Execution
    Trigger quadratic merge resolution
  5. Persist
    Exhaust CPU / stall event loop
  6. Impact
    Denial of service

Vulnerability Assessment

Weakness
CWE
CWE-407
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
Exploitation Conditions

The specific prerequisite is that a vulnerable js-yaml version (3.0.0-3.14.x or 4.0.0-4.2.x) must parse attacker-controlled YAML content, and the malicious document must use the YAML merge-key ('<<') feature arranged as a chain of mappings where each mapping merges the previous one. There is no authentication, privilege, or user-interaction requirement (PR:N/UI:N). The principal limiting factor is exposure: the application must actually route untrusted input through js-yaml's load/parse path - services that parse only trusted, developer-authored YAML are not realistically exploitable. Impact is limited to availability (CPU exhaustion / event-loop stall); no data disclosure or code execution results.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent: network-reachable, low complexity, no privileges or interaction, and a pure availability impact with no confidentiality or integrity loss - a classic algorithmic-complexity DoS rather than a data-exposure or code-execution bug. Note that the input Tags label this 'Information Disclosure,' which conflicts with the description and the C:N/I:N vector; the tag appears to be mislabeled and should be disregarded in favor of the DoS characterization. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure is unquantified; there is no public exploit identified at time of analysis and it is not in CISA KEV. Real-world priority is moderate and context-dependent: it is only exploitable where a vulnerable js-yaml version parses attacker-influenced YAML (e.g., user-uploaded config, API request bodies, CI inputs). For services that only parse trusted local YAML the practical risk is low despite the 7.5 score.
Exploit ScenarioDerived

An attacker submits a small (kilobytes-sized) YAML payload to any endpoint that feeds user input into a vulnerable js-yaml parser - for example a configuration upload, a webhook, or an API body parsed as YAML. The payload is a chain of mappings each merging the previous via merge keys, forcing quadratic CPU consumption that pins the Node.js event loop and stalls the service for all users. No exploit code is publicly identified at time of analysis, but the payload is trivial to construct given the described merge-key chaining and the low attack complexity (AC:L).
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Denial of service in js-yaml (a widely-used JavaScript YAML parser) 3.0.0-3.14.x and 4.0.0-4.2.x allows remote attackers to consume quadratic CPU time by submitting a linearly-sized YAML document built from a chain of mappings that use merge keys, where each mapping merges the previous one. Exploitation requires no authentication or user interaction (CVSS 7.5, availability-only impact), and any application that parses attacker-controlled YAML with a vulnerable version is affected. No public exploit identified at time of analysis; fixes are available in 3.15.0 and 4.3.0.

RemediationAI

Vendor-released patch: upgrade to js-yaml 4.3.0 (for the 4.x line) or 3.15.0 (for applications still on 3.x), which contain the fix (commits 24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 and 59423c6f8cdc78742ac00e25a4dd39ef16b702e4). Because js-yaml is frequently a transitive dependency, audit your dependency tree (npm ls js-yaml) and force resolution/override of nested copies, not just the top-level package. Where immediate upgrade is not possible, compensating controls are to stop parsing untrusted YAML with the vulnerable version, cap the accepted input size before parsing, and/or run parsing under a CPU/time budget or worker thread that can be terminated - with the trade-off that size caps may reject legitimate large documents and timeouts add latency and complexity. Details: https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m.

Affected VersionsENISA

js-yaml 4.0.0, < 4.3.0
js-yaml 3.0.0, < 3.15.0

Affected Packages

npm js-yaml fix: 3.15.0, 4.3.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

js-yaml (npm package by nodeca) is one of the most heavily-depended-upon YAML parsers in the JavaScript/Node.js ecosystem, used directly and transitively across build tools, configuration loaders, and web frameworks. The root cause is CWE-407 (Inefficient Algorithmic Complexity): the YAML merge key feature (the '<<' key defined by the YAML 1.1 merge specification) lets one mapping inherit another mapping's keys. When mappings are chained so that each successive mapping merges the previous one, resolving the merges causes the parser to repeatedly copy/expand the accumulated key set, turning a document that grows linearly in size into O(n²) work. The affected component is cpe:2.3:a:nodeca:js-yaml, all versions in the 3.0.0-3.14.x and 4.0.0-4.2.x ranges.

Know when Js Yaml gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Untrusted YAML is parsed remotely with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is pure CPU-exhaustion DoS, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Patch available
Jul 08, 2026 - 17:01 EUVD

DescriptionCVE.org

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on js-yaml (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

Executive ViewAI

Why It Matters

js-yaml, a widely-used YAML parser in JavaScript applications, contains a denial-of-service vulnerability affecting versions 3.0.0-3.14.x and 4.0.0-4.2.x that allows attackers to consume CPU resources through specially crafted YAML documents, potentially disrupting service availability for any application parsing untrusted YAML input. This affects organizations whose applications depend on js-yaml and accept YAML from external sources, creating uptime and performance risk without confidentiality or integrity breach.

Business Impact: High
Compensating Controls

Vendor-released patch: js-yaml 3.15.0 (for 3.x branch) and 4.3.0 (for 4.x branch). If immediate patching is blocked, restrict YAML parsing to trusted sources only and implement rate limiting and CPU resource quotas on parsing services to mitigate quadratic DoS impact.

Threat Intelligence Overview

EPSS Score
0.4%
Top 73% exploitable
Prevalence
Ubiquitous
js-yaml is a core YAML parser depended on across the npm ecosystem
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Js Yaml

View all
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2026-84375 HIGH POC
7.5 Sep 01

Uncontrolled CPU consumption in js-yaml versions 3.0.0-3.15.1 and 4.0.0-4.3.1 allows unauthenticated remote attackers to
CVE-2026-59868 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml Node.js YAML parser (versions 5.0.0 up to but not including 5.2.0) lets a remote attack
CVE-2026-59870 HIGH POC
7.5 Jul 08

Denial of service in the js-yaml JavaScript YAML parser (versions 5.0.0 up to but not including 5.2.1) allows remote att
CVE-2025-64718 MEDIUM
5.3 Nov 13

js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploit

Same weakness CWE-407 – Inefficient Algorithmic Complexity

View all
CVE-2026-54892 HIGH POC
8.7
CVE-2026-90776 HIGH POC
8.7
CVE-2026-59094 HIGH POC
8.7
CVE-2026-13311 HIGH POC
8.7
CVE-2026-54284 HIGH POC
8.7
CVE-2022-45061 HIGH POC
7.5
CVE-2026-71321 HIGH POC
7.5
CVE-2026-56669 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:37532 ADVISORY https://access.redhat.com/errata/RHSA-2026:37534 ADVISORY https://access.redhat.com/errata/RHSA-2026:37577 ADVISORY https://access.redhat.com/errata/RHSA-2026:38187 ADVISORY https://access.redhat.com/errata/RHSA-2026:38236 ADVISORY https://access.redhat.com/errata/RHSA-2026:38304 ADVISORY https://access.redhat.com/errata/RHSA-2026:40415 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-59869 ADVISORY https://vuldb.com/vuln/376913 REF https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 REF https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4 REF https://github.com/nodeca/js-yaml/releases/tag/3.15.0 REF https://github.com/nodeca/js-yaml/releases/tag/4.3.0 REF https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy