CVE-2026-59869
1 advisory.
npm/js-yaml CVE-2026-59869: high 7.5
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Action: Upgrade js-yaml to 3.15.0 or later.
npm i js-yaml@3.15.0npm i js-yaml@4.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.15.0 | - |
| 4.0.0 | 4.3.0 | - |
Fixed versions
| 3.15.0 | 4.3.0 |
Sources
- osv: GHSA-52cp-r559-cp3m
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
- https://nvd.nist.gov/vuln/detail/CVE-2026-59869
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
- https://github.com/nodeca/js-yaml
- https://github.com/nodeca/js-yaml/releases/tag/3.15.0
- https://github.com/nodeca/js-yaml/releases/tag/4.3.0
CVE-2026-59869 · published · modified · JSON