js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

🗓️ 30 Jun 2026 22:56:15Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

A flaw in js-yaml enables Denial of Service from crafted ordered-map YAML input, causing high CPU usage.

Reporter	Title	Published	Views	Family All 41
ATTACKERKB	CVE-2026-59870	8 Jul 202615:13	–	attackerkb
Circl	CVE-2026-59870	20 Jul 202622:37	–	circl
CVE	CVE-2026-59870	8 Jul 202615:13	–	cve
Cvelist	CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing	8 Jul 202615:13	–	cvelist
Debian CVE	CVE-2026-59870	8 Jul 202615:13	–	debiancve
EUVD	EUVD-2026-42300	20 Jul 202621:18	–	euvd
Github Security Blog	js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA	20 Jul 202621:18	–	github
NVD	CVE-2026-59870	8 Jul 202616:16	–	nvd
OSV	CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing	8 Jul 202615:13	–	osv
OSV	GHSA-724G-MXRG-4QVM js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA	20 Jul 202621:18	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	nodejs26	26.4.0-1.3.hum1	nodejs26-26.4.0-1.3.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	nodejs26	26.4.0-1.3.hum1	nodejs26-26.4.0-1.3.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	nodejs26-bin	26.4.0-1.3.hum1	nodejs26-bin-26.4.0-1.3.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-59870
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
github	www.github.com/nodeca/js-yaml/releases/tag/5.2.1
github	www.github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59870
cve	www.cve.org/CVERecord

22 Jul 2026 18:35Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3 - 7.5

EPSS0.00358

SSVC

yaml parser flaw ordered map input denial of service high cpu usage