js-yaml: js-yaml: Denial of Service via crafted YAML documents

🗓️ 10 Jul 2026 05:14:22Reported by RedHatType

redhat🔗 access.redhat.com👁 40 Views

Vulnerability in javascript yaml allows denial of service from crafted YAML with merge keys causing high CPU usage.

Reporter	Title	Published	Views	Family All 423
IBM Security Bulletins	Security Bulletin: Vulnerability in js-yaml affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Aug 202610:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	20 Jul 202615:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses js-yaml-4.1.1.tgz which is vulnerable to multiple CVEs.	27 Aug 202619:42	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie	24 Jul 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub	27 Aug 202619:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses js-yaml which is vulnerable to CVE-2025-64718, CVE-2026-53550, CVE-2026-59869	10 Aug 202611:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.	1 Sep 202618:47	–	ibm
ATTACKERKB	CVE-2026-59869	8 Jul 202615:15	–	attackerkb
Atlassian	DoS (Denial of Service) js-yaml Dependency in Bitbucket Data Center	11 Aug 202611:30	–	atlassian

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	aspnetcore-runtime-8.0	8.0.28-1.1.hum1	aspnetcore-runtime-8.0-8.0.28-1.1.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	aspnetcore-runtime-8.0	8.0.28-1.1.hum1	aspnetcore-runtime-8.0-8.0.28-1.1.hum1.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-59869
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
github	www.github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
github	www.github.com/nodeca/js-yaml/releases/tag/3.15.0
github	www.github.com/nodeca/js-yaml/releases/tag/4.3.0
github	www.github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59869
cve	www.cve.org/CVERecord

08 Sep 2026 22:48Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

EPSS0.00544

SSVC

denial of service javascript yaml yaml parser merge keys crafted document cpu usage remote attacker