CVE-2026-59869 HIGH

CVE-2026-59869: js-yaml: YAML merge-key chains can force quadratic CPU consumption

Vendor Nodeca
Product js-yaml
Weakness CWE-407
Published July 8, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 9, 2026 Record updated