CVE-2026-59868
MEDIUMjs-yaml: YAML merge-key chains can force quadratic CPU consumption
Title source: cnaDescription
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv
X_Refsource_Misc x_refsource_misc
https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
X_Refsource_Misc x_refsource_misc
https://github.com/nodeca/js-yaml/releases/tag/5.2.0
Scores
CVSS v3
5.3
EPSS
0.0041
EPSS Percentile
33.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-407
CWE-770
Status
published
Products (3)
nodeca/js-yaml
5.0.0 - 5.2.0
nodeca/js-yaml
>= 5.0.0, < 5.2.0
npm/js-yaml
5.0.0 - 5.2.0npm
Published
Jul 08, 2026
Tracked Since
Jul 08, 2026