{"action":"Upgrade js-yaml to 5.2.1 or later.","affected":[{"fixed":"5.2.1","introduced":"5.0.0"}],"component":"js-yaml","cve_ids":["CVE-2026-59870"],"ecosystem":"npm","epss":0.0074,"exploited":false,"fixed_versions":["5.2.1"],"ghsa_id":"GHSA-724g-mxrg-4qvm","id":"tcs_01M5KF8CTZQ8CVVGE0SBQFQZ8Z","modified_at":"2026-09-10T03:50:51.442129612Z","published_at":"2026-07-20T21:18:51Z","references":["https://osv.dev/vulnerability/GHSA-724g-mxrg-4qvm","https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","https://nvd.nist.gov/vuln/detail/CVE-2026-59870","https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","https://github.com/nodeca/js-yaml","https://github.com/nodeca/js-yaml/releases/tag/5.2.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-724g-mxrg-4qvm","url":"https://osv.dev/vulnerability/GHSA-724g-mxrg-4qvm"}],"summary":"js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA"}