CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
Attackers can cause excessive CPU consumption and service unavailability by submitting crafted YAML documents with merge key chains to applications using js-yaml.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59869?
CVE-2026-59869 is a high-severity denial of service vulnerability in nodeca js-yaml, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Weakness: CWE-407
Which versions are affected by CVE-2026-59869?
4 open source packages ship an affected version, including js-yaml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
js-yaml npm | From 3.0.0 | 3.15.0 |
js-yaml npm | From 3.0.0 | 3.15.0 |
js-yaml npm | From 4.0.0 | 4.3.0 |
js-yaml npm | From 4.0.0 | 4.3.0 |
Linux distribution packages (18)
nodejs22 Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs22-bin Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs22-devel Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs22-docs Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs22-full-i18n Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs22-libs Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs22-npm Red Hat:hummingbird:1 | All versions | 0:10.9.8-1.22.23.1.2.1.hum1 |
nodejs22-npm-bin Red Hat:hummingbird:1 | All versions | 0:22.23.1-2.1.hum1 |
nodejs26 Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
nodejs26-bin Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
nodejs26-devel Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
nodejs26-docs Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
nodejs26-full-i18n Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
nodejs26-libs Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
nodejs26-npm Red Hat:hummingbird:1 | All versions | 0:11.17.0-1.26.4.0.1.4.hum1 |
nodejs26-npm-bin Red Hat:hummingbird:1 | All versions | 0:26.4.0-1.4.hum1 |
v8-12.4-devel Red Hat:hummingbird:1 | All versions | 0:12.4.254.21-1.22.23.1.2.1.hum1 |
v8-14.6-devel Red Hat:hummingbird:1 | All versions | 0:14.6.202.34-1.26.4.0.1.4.hum1 |
Products include Nodeca Js-Yaml.
How do I fix CVE-2026-59869?
Upgrade js-yaml to a fixed version for your release line: 3.15.0 or 4.3.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59869 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59869 exists.
Other vulnerabilities in nodeca js-yaml
- CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
- CVE-2013-4660 Deserialization Code Execution in js-yaml
- CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption
- CVE-2026-53550 js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
- CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
Sources
Also known as AZL-92192, CLEANSTART-2026-JG14084, CLEANSTART-2026-LP47125, CLEANSTART-2026-LU28686, CLEANSTART-2026-QF29635, CLEANSTART-2026-RI71860 and 45 more.