CVE-2026-59870

HIGH 7.5

js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

CVSS Score

7.5

EPSS Score

0.6%

EPSS Percentile

49th

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

CWE	CWE-407
Vendor	nodeca
Product	js-yaml
Published	Jul 8, 2026
Last Updated	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for nodeca js-yaml

Be the first to know when new high vulnerabilities affecting nodeca js-yaml are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

nodeca / js-yaml

>= 5.0.0, < 5.2.1 >= 3.0.0, < 3.15.1 >= 4.0.0, < 4.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm github.com: https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded github.com: https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe github.com: https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a github.com: https://github.com/nodeca/js-yaml/releases/tag/3.15.1 github.com: https://github.com/nodeca/js-yaml/releases/tag/4.3.1 github.com: https://github.com/nodeca/js-yaml/releases/tag/5.2.1