What’s Vulnerable › Vulnerabilities

CVE-2026-59870: js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-407

Description

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

Affected products

• nodeca js-yaml: from 5.0.0 before 5.2.1 — fixed in 5.2.1

How to fix

Upgrade to a fixed version: nodeca js-yaml 5.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded
• https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
• https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a
• https://github.com/nodeca/js-yaml/releases/tag/3.15.1
• https://github.com/nodeca/js-yaml/releases/tag/4.3.1
• https://github.com/nodeca/js-yaml/releases/tag/5.2.1
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
• https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm

Get alerted when CVE-2026-59870 or the next vulnerability affects your stack