CVE-2026-59868

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1	Patch
https://github.com/nodeca/js-yaml/releases/tag/5.2.0	Release Notes
https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv	Exploit Vendor Advisory
https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 5.0.0 antes de la 5.2.0, cuando las claves de fusión están habilitadas, js-yaml puede consumir tiempo de CPU cuadrático al analizar un documento cuyo tamaño crece solo linealmente cuando una cadena de mapeos utiliza claves de fusión donde cada mapeo fusiona el anterior. Este problema está solucionado en la versión 5.2.0.

Information

Published : 2026-07-08 16:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-59868

Mitre link : CVE-2026-59868

CVE.ORG link : CVE-2026-59868

JSON object : View

Products Affected

nodeca

js-yaml

CWE

CWE-407

Inefficient Algorithmic Complexity

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-59868", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59868", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:41:56.104624Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nodeca", "product": "js-yaml", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.2.0"}]}]}], "published": "2026-07-08T16:16:33.270", "references": [{"url": "https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/releases/tag/5.2.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0."}, {"lang": "es", "value": "js-yaml es un analizador y volcador YAML de JavaScript. Desde la versi\u00f3n 5.0.0 antes de la 5.2.0, cuando las claves de fusi\u00f3n est\u00e1n habilitadas, js-yaml puede consumir tiempo de CPU cuadr\u00e1tico al analizar un documento cuyo tama\u00f1o crece solo linealmente cuando una cadena de mapeos utiliza claves de fusi\u00f3n donde cada mapeo fusiona el anterior. Este problema est\u00e1 solucionado en la versi\u00f3n 5.2.0."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8C8E7342-F2B6-4FD8-9FC4-E003EDAA68BC", "versionEndExcluding": "5.2.0", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}