CVE-2026-59870

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59870

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59870.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-59870

Aliases

GHSA-724g-mxrg-4qvm

Downstream

CGA (2)

CLSA (1)

CLSA-2026-1787592038

RHSA (8)

UBUNTU (1)

UBUNTU-CVE-2026-59870

Published

2026-07-08T15:13:20Z

Modified

2026-10-08T02:47:02Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

Details

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59870.json"
}

References

Affected packages

Git / github.com/nodeca/js-yaml

Affected ranges

Type

GIT

Repo

https://github.com/nodeca/js-yaml

Events

Introduced

75148bc4f5eb69b3d338e1c355d8bb2dba5bdf34

Fixed

ac16b42c46c11c5c7f66062bfc78b168b5f07ecd

Fixed

22a8071ef032117bc6249c330b240ac3aa2d3ded

Fixed

39f3211a2f01b3c6982710cf21434ab7060acefe

Fixed

c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a

Fixed

ab85ae2c622bc6d8cdbceccafe9f9b7df80463ed

Fixed

86e91b815b8794c3c73a179c1770871e37ec2df8

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*",
    "extracted_events":  [
        {
            "introduced":  "5.0.0"
        },
        {
            "fixed":  "5.2.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

5.*

5.0.0

5.1.0

5.2.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59870.json"