VYPR
← All advisories
Medium severity5.3OSV Advisory· Published Jul 8, 2026· Updated Jul 10, 2026

CVE-2026-59870

CVE-2026-59870

Description

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
js-yamlnpm
>= 5.0.0, < 5.2.15.2.1

Affected products

5
  • Nodeca/Js YAMLOSV3 versions
    5.2.0, 5.1.0, 5.0.0+ 2 more
    • (no CPE)range: 5.2.0, 5.1.0, 5.0.0
    • cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*range: >=5.0.0,<5.2.1
    • (no CPE)range: >=5.0.0 <5.2.1
  • osv-coords2 versions
    pkg:apk/chainguard/renovatepkg:apk/wolfi/renovate
    < 44.3.3-r0+ 1 more
    • (no CPE)range: < 44.3.3-r0
    • (no CPE)range: < 44.3.3-r0

Patches

Vulnerability mechanics

References

5

News mentions

1