Nodeca Js YAML: Three CPU-Exhausting Parsing Vulnerabilities Disclosed Together
Nodeca's Js YAML parser is affected by three vulnerabilities (CVE-2026-59870, CVE-2026-59869, CVE-2026-59868) causing excessive CPU usage due to inefficient parsing.
Key findings
- Three CPU-exhausting vulnerabilities disclosed in Nodeca's Js YAML on July 9, 2026.
- Vulnerabilities stem from quadratic CPU complexity in handling merge keys and !!omap tags.
- Affected versions range from 3.0.0 to 5.2.1, depending on the specific CVE.
- Patches are available in versions 3.15.0, 4.3.0, 5.2.0, and 5.2.1.
On July 9, 2026, three vulnerabilities were disclosed in Nodeca's Js YAML, a popular JavaScript YAML parser and dumper. These vulnerabilities, all stemming from inefficient parsing of specially crafted YAML documents, could lead to excessive CPU consumption, potentially causing denial-of-service conditions. The disclosures highlight a pattern of quadratic CPU time complexity when handling merge keys or specific schema tags.
Two of the vulnerabilities, CVE-2026-59869 and CVE-2026-59868, are related to the handling of merge keys. In both cases, when merge keys are enabled, the parser can consume quadratic CPU time when processing a document where a chain of mappings merges previous ones. This creates a performance bottleneck where the document size grows linearly, but the parsing time grows quadratically. CVE-2026-59869 affects versions from 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, while CVE-2026-59868 affects versions from 5.0.0 before 5.2.0.
The third vulnerability, CVE-2026-59870, also involves quadratic CPU consumption but is specifically related to the support for the !!omap tag within the YAML11 schema. In versions 5.0.0 before 5.2.1, the implementation of omapTag.addItem() performs a linear duplicate-key scan on every insertion. This leads to O(n^2) CPU usage when parsing a crafted ordered-map document.
The Js YAML project has addressed these issues through targeted updates. CVE-2026-59869 is fixed in versions 3.15.0 and 4.3.0. CVE-2026-59868 is resolved in version 5.2.0. CVE-2026-59870 is addressed in version 5.2.1. Users of Js YAML are strongly advised to update to the patched versions to mitigate the risk of denial-of-service attacks exploiting these parsing inefficiencies. The consistent disclosure of these related issues underscores the importance of thorough security testing for parsers handling complex data structures.