js-yaml: js-yaml: Denial of Service via crafted YAML documents

🗓️ 10 Jul 2026 03:39:01Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

A vulnerability in js-yaml allows remote attacker to cause DoS with a crafted YAML using merge keys.

Reporter	Title	Published	Views	Family All 33
attackerkb	CVE-2026-59869	8 Jul 202615:15	–	attackerkb
circl	CVE-2026-59869	11 Jul 202600:05	–	circl
cve	CVE-2026-59869	8 Jul 202615:15	–	cve
cvelist	CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption	8 Jul 202615:15	–	cvelist
debiancve	CVE-2026-59869	8 Jul 202615:15	–	debiancve
euvd	EUVD-2026-42301	8 Jul 202615:15	–	euvd
nvd	CVE-2026-59869	8 Jul 202616:16	–	nvd
osv	CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption	8 Jul 202615:15	–	osv
osv	DEBIAN-CVE-2026-59869	8 Jul 202616:16	–	osv
osv	RHSA-2026:37534 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update	13 Jul 202610:07	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	aarch64	nodejs25	25.9.0-1.3.hum1	nodejs25-25.9.0-1.3.hum1.aarch64.rpm
Red Hat Hardened Images	20251124	x86_64	nodejs25	25.9.0-1.3.hum1	nodejs25-25.9.0-1.3.hum1.x86_64.rpm
Red Hat Hardened Images	20251124	noarch	nodejs25-bin	25.9.0-1.3.hum1	nodejs25-bin-25.9.0-1.3.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-59869
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
github	www.github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
github	www.github.com/nodeca/js-yaml/releases/tag/3.15.0
github	www.github.com/nodeca/js-yaml/releases/tag/4.3.0
github	www.github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59869
cve	www.cve.org/CVERecord

15 Jul 2026 14:59Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.0037

SSVC

yaml parser denial of service merge keys remote attacker