Log in Start free

Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-59870js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

High 7.5

In plain English

A high-severity security flaw in js-yaml from nodeca. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSnode-js-yamlno fix listedUBUNTU-CVE-2026-59870
Ubuntu:24.04:LTSnode-js-yamlno fix listedUBUNTU-CVE-2026-59870
Ubuntu:25.10node-js-yamlno fix listedUBUNTU-CVE-2026-59870
Ubuntu:26.04:LTSnode-js-yamlno fix listedUBUNTU-CVE-2026-59870
Ubuntu:26.10node-js-yamlno fix listedUBUNTU-CVE-2026-59870
npmjs-yaml5.2.1GHSA-724g-mxrg-4qvm

Affected products (as reported)

VendorProductVersions
nodeca js-yaml >= 5.0.0, < 5.2.1>= 3.0.0, < 3.15.1>= 4.0.0, < 4.3.1

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References