CVE-2026-59869 PUBLISHED

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Assigner: GitHub_M
Reserved: 07.07.2026 Published: 08.07.2026 Updated: 08.07.2026

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	nodeca
Product	js-yaml
Versions	Version >= 3.0.0, < 3.15.0 is affected Version >= 4.0.0, < 4.3.0 is affected

References

https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
https://github.com/nodeca/js-yaml/releases/tag/3.15.0
https://github.com/nodeca/js-yaml/releases/tag/4.3.0

Problem Types

CWE-407: Inefficient Algorithmic Complexity CWE