CVE-2026-59870 | Vulnetix

CVE-2026-59870 PUBLISHED CVSS 7.5 HIGH

Reported by GitHub_M · Published July 8, 2026

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
nodeca	js-yaml	>= 5.0.0, < 5.2.1, >= 3.0.0, < 3.15.1, >= 4.0.0, < 4.3.1
nodeca	js-yaml	>= 4.0.0, < 4.3.1, >= 3.0.0, < 3.15.1, >= 5.0.0, < 5.2.1
wolfi	renovate	0, 0, 0
npm	js-yaml	5.0.0
chainguard	renovate	0, 0, 0

Timeline

Jul 8, 2026 CVE Published
Jul 9, 2026 EPSS Score
Jul 9, 2026 Coalition ESS Score
Aug 7, 2026 EPSS Score
Aug 13, 2026 Security Advisory
Aug 24, 2026 EPSS Score
Aug 26, 2026 EPSS Score
Aug 28, 2026 EPSS Score
Aug 30, 2026 EPSS Score
Sep 3, 2026 EPSS Score
Sep 5, 2026 EPSS Score
Sep 6, 2026 EPSS Score

References

https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm x_refsource_CONFIRM
https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/3.15.1 x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/4.3.1 x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/5.2.1 x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2026-59870 advisory
https://github.com/advisories/GHSA-724g-mxrg-4qvm advisory

Open in Interactive Console →