CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

🗓️ 08 Jul 2026 15:13:20Reported by GoogleType

osv🔗 osv.dev👁 2 Views

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU cons...

Reporter	Title	Published	Views	Family All 28
ATTACKERKB	CVE-2026-59870	8 Jul 202615:13	–	attackerkb
CVE	CVE-2026-59870	8 Jul 202615:13	–	cve
Cvelist	CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing	8 Jul 202615:13	–	cvelist
Debian CVE	CVE-2026-59870	8 Jul 202615:13	–	debiancve
EUVD	EUVD-2026-42300	8 Jul 202615:13	–	euvd
NVD	CVE-2026-59870	8 Jul 202616:16	–	nvd
OSV	RHSA-2026:26994 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update	18 Jun 202610:10	–	osv
OSV	RHSA-2026:33866 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	1 Jul 202610:19	–	osv
OSV	RHSA-2026:34478 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	2 Jul 202610:17	–	osv
OSV	RHSA-2026:34975 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update	4 Jul 202610:07	–	osv

Source	Link
github	www.github.com/nodeca/js-yaml/releases/tag/5.2.1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59870.json
github	www.github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59870
github	www.github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe

12 Jul 2026 04:03Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.3

EPSS0.00358