CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

High 7.5 Published 8 Jul 2026 Updated 6 Oct 2026

Attackers can cause CPU exhaustion and denial of service by submitting crafted YAML documents with ordered maps to applications using the js-yaml library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-59870?

CVE-2026-59870 is a high-severity denial of service vulnerability in nodeca js-yaml, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

Weakness: CWE-770, CWE-407

Which versions are affected by CVE-2026-59870?

2 open source packages ship an affected version, including js-yaml. It affects 1 product.

Package	Affected	Fixed in
`js-yaml` npm	From `5.0.0`	`5.2.1`
`js-yaml` npm	From `5.0.0`	`5.2.1`

Products include Nodeca Js-Yaml.

How do I fix CVE-2026-59870?

Upgrade js-yaml to 5.2.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-59870 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59870 exists.

Sources

Also known as CLSA-2026-1787592038, CLSA-2026-1790944389, CLSA-2026-1790950175, CLSA-2026-1792755810, GHSA-724g-mxrg-4qvm, UBUNTU-CVE-2026-59870.