{"action":"Upgrade js-yaml to 3.15.1 or later.","affected":[{"fixed":"4.3.1","introduced":"4.0.0"},{"fixed":"3.15.1","introduced":"3.0.0"}],"component":"js-yaml","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["4.3.1","3.15.1"],"ghsa_id":"GHSA-5p4m-2wfm-xmqj","id":"tcs_01M5KF48ZKSWCAHAMVG2NA6JK1","modified_at":"2026-09-10T03:50:53.407436483Z","published_at":"2026-08-06T20:27:32Z","references":["https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj","https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj","https://github.com/nodeca/js-yaml"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5p4m-2wfm-xmqj","url":"https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj"}],"summary":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported"}