VYPR
← All advisories
High severity7.5OSV Advisory· Published Jul 8, 2026· Updated Jul 13, 2026

CVE-2026-59869

CVE-2026-59869

Description

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
js-yamlnpm
>= 3.0.0, < 3.15.03.15.0
js-yamlnpm
>= 4.0.0, < 4.3.04.3.0

Affected products

74

Patches

Vulnerability mechanics

References

7

News mentions

1