CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption

Medium 5.3 Published 8 Jul 2026 Updated 9 Jul 2026

Attackers can cause excessive CPU consumption via crafted YAML merge keys, leading to denial of service in applications using the js-yaml library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59868?

CVE-2026-59868 is a medium-severity denial of service vulnerability in nodeca js-yaml, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

Weakness: CWE-770, CWE-407

Which versions are affected by CVE-2026-59868?

2 open source packages ship an affected version, including js-yaml. It affects 1 product.

Package	Affected	Fixed in
`js-yaml` npm	From `5.0.0`	`5.2.0`
`js-yaml` npm	From `5.0.0`	`5.2.0`

Products include Nodeca Js-Yaml.

How do I fix CVE-2026-59868?

Upgrade js-yaml to 5.2.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-59868 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59868 exists.

Sources

Also known as CLSA-2026-1784596307, GHSA-g796-fgmg-93mv, UBUNTU-CVE-2026-59868.