Medium severity5.3OSV Advisory· Published Jul 8, 2026· Updated Jul 13, 2026

CVE-2026-59868

Description

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
js-yamlnpm	>= 5.0.0, < 5.2.0	5.2.0

Affected products

Nodeca/Js YAMLOSV3 versions
5.1.0, 5.0.0+ 2 more
- (no CPE)range: 5.1.0, 5.0.0
- (no CPE)range: <5.2.0
- cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*range: >=5.0.0,<5.2.0

Patches

Vulnerability mechanics

References

github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1nvdPatchWEB
github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mvnvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-g796-fgmg-93mvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-59868ghsaADVISORY
github.com/nodeca/js-yaml/releases/tag/5.2.0nvdRelease NotesWEB

News mentions

Nodeca Js YAML: Three CPU-Exhausting Parsing Vulnerabilities Disclosed Together
Vypr Intelligence · Jul 9, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000