CVE-2026-59868: js-yaml Denial-of-Service via Merge Key Complexity

Technical summary

CVE-2026-59868 exploits algorithmic complexity in js-yaml's merge key handling. YAML merge keys (the '<<' key) allow one mapping to inherit properties from another. When a chain of nested mappings each merges the previous one, the parser's processing time grows quadratically relative to document size. This occurs because each merge operation may re-process previously merged content, compounding work across the chain. The issue manifests only when merge keys are explicitly enabled during parsing, which is not the default in all contexts but is commonly used in configuration systems and data loaders. CWE-407 (Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling) both apply.

Business impact

Applications and services that parse untrusted or user-supplied YAML documents using js-yaml are at risk of denial-of-service attacks. This is particularly concerning for configuration management systems, CI/CD pipelines, container orchestration tools, and any microservice that accepts YAML input from clients or external sources. An attacker with no authentication can submit a small malicious YAML file that exhausts server CPU, degrading availability for legitimate users. The impact is amplified in cloud environments where resource exhaustion directly translates to financial costs and service unavailability.

Affected systems

The vulnerability affects js-yaml versions 5.0.0 through 5.1.x (inclusive). Version 5.2.0 and later contain the fix. Any application or library that depends on js-yaml in the affected version range is exposed if it parses YAML with merge keys enabled. This includes web services, Node.js applications, build tools, and deployment automation that process YAML configuration files or accept YAML input. The Nodeca js-yaml package is the primary affected product; developers should verify whether their dependency tree includes js-yaml and which version is in use.

Exploitability

Exploitation requires minimal skill and no special privileges. An attacker simply needs to craft a YAML document with a chain of merge keys and submit it to an application that parses YAML with merge keys enabled. The CVSS vector reflects a network-accessible vulnerability with low attack complexity and no user interaction required. However, exploitation depends on merge keys being enabled in the parsing configuration; applications that explicitly disable merge keys are not vulnerable. Proof-of-concept is straightforward and does not require advanced knowledge of YAML internals.

Remediation

Upgrade js-yaml to version 5.2.0 or later. Organizations should audit their dependency trees using tools like npm audit or yarn audit to identify where js-yaml is pinned or transitioned as a dependency. If immediate patching is not feasible, consider disabling YAML merge keys in the parser configuration if the application does not require them. This is typically done by setting the 'merge' option to false when instantiating the parser. Document which services and applications use js-yaml to ensure no systems are missed during patching.

Patch guidance

Update js-yaml to version 5.2.0 or later via npm (npm install js-yaml@latest or npm install [email protected]). Verify the patch by checking the installed version with npm list js-yaml. For applications using package-lock.json or yarn.lock, ensure the lock file is updated. Test parsing of existing YAML documents after patching to confirm compatibility and that no application logic depends on version-specific parsing quirks. For pinned dependencies, update the version constraint in package.json and re-test before deploying to production. Verify against the vendor advisory at the Nodeca js-yaml repository for any release notes specific to your application's use case.

Detection guidance

Monitor for unusual CPU spikes correlating with YAML parsing events in application logs. Implement resource limits and timeouts on YAML parsing operations to catch algorithmic complexity attacks before they impact availability. Network-level detection is difficult since the payload is small and the attack is semantic rather than signature-based. Endpoint detection and response (EDR) solutions may flag sustained high CPU consumption from the application process. Update security scanning tools and SBOM (Software Bill of Materials) processes to flag js-yaml versions below 5.2.0. Consider adding input validation to reject YAML documents with excessive merge key nesting before they reach the parser.

Why prioritize this

While the CVSS score of 5.3 is moderate, this vulnerability should be prioritized for remediation because: (1) exploitation is trivial and requires no authentication; (2) any public-facing service parsing YAML is at risk; (3) the fix is simple and low-risk; (4) the attack can cascade across microservice architectures if YAML is passed between services. Organizations should treat this as a medium-priority fix to be completed within the next patch cycle, particularly for customer-facing APIs and configuration systems.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible denial-of-service vulnerability with low attack complexity and no user interaction required. The impact is limited to availability (A:L) with no impact on confidentiality or integrity, tempering the severity. The score appropriately captures the risk profile: a real and exploitable flaw, but not a critical escalation or data breach vector. The actual operational risk to individual organizations may be higher or lower depending on whether they expose YAML parsing to untrusted input and whether merge keys are enabled.

Frequently asked questions