CVE-2026-59868 PUBLISHED

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Assigner: GitHub_M
Reserved: 07.07.2026 Published: 08.07.2026 Updated: 08.07.2026

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	nodeca
Product	js-yaml
Versions	Version >= 5.0.0, < 5.2.0 is affected

References

https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv
https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
https://github.com/nodeca/js-yaml/releases/tag/5.2.0

Problem Types

CWE-407: Inefficient Algorithmic Complexity CWE