CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7	Patch
https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4	Patch
https://github.com/nodeca/js-yaml/releases/tag/3.15.0	Release Notes
https://github.com/nodeca/js-yaml/releases/tag/4.3.0	Release Notes
https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m	Exploit Vendor Advisory
https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nodeca:js-yaml::::::node.js::*
	cpe:2.3:a:nodeca:js-yaml::::::node.js::*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 3.0.0 hasta antes de la 3.15.0 y desde la 4.0.0 hasta antes de la 4.3.0, js-yaml puede consumir tiempo de CPU cuadrático al analizar un documento cuyo tamaño crece solo linealmente cuando una cadena de mapeos utiliza claves de fusión donde cada mapeo fusiona el anterior. Este problema está solucionado en las versiones 3.15.0 y 4.3.0.

Information

Published : 2026-07-08 16:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-59869

Mitre link : CVE-2026-59869

CVE.ORG link : CVE-2026-59869

JSON object : View

Products Affected

nodeca

js-yaml

CWE

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-59869", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59869", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T15:14:16.302841Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nodeca", "product": "js-yaml", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.15.0"}, {"status": "affected", "version": ">= 4.0.0, < 4.3.0"}]}]}], "published": "2026-07-08T16:16:33.423", "references": [{"url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0."}, {"lang": "es", "value": "js-yaml es un analizador y volcador YAML de JavaScript. Desde la versi\u00f3n 3.0.0 hasta antes de la 3.15.0 y desde la 4.0.0 hasta antes de la 4.3.0, js-yaml puede consumir tiempo de CPU cuadr\u00e1tico al analizar un documento cuyo tama\u00f1o crece solo linealmente cuando una cadena de mapeos utiliza claves de fusi\u00f3n donde cada mapeo fusiona el anterior. Este problema est\u00e1 solucionado en las versiones 3.15.0 y 4.3.0."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F0303A0E-076A-425B-9746-6C685213D721", "versionEndExcluding": "3.15.0", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "90F8FD99-9730-49E7-B8AC-97BBF4658327", "versionEndExcluding": "4.3.0", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}