CVE-2026-59869: js-yaml Quadratic CPU Complexity DoS Vulnerability

Technical summary

The vulnerability stems from inefficient algorithmic handling of YAML merge keys in chained mapping structures. When a YAML document contains a series of mappings where each mapping merges the previous one using the merge key operator, the parser's internal processing becomes increasingly expensive. Specifically, the quadratic time complexity emerges because the parser re-processes previously merged keys multiple times rather than efficiently tracking state. The flaw is present in js-yaml versions 3.0.0–3.14.x and 4.0.0–4.2.x. The issue was resolved in versions 3.15.0 and 4.3.0 by optimizing the merge-key handling logic to avoid redundant processing. This is categorized as CWE-407 (Inefficient Algorithmic Complexity).

Business impact

Organizations deploying js-yaml in server-side YAML parsing contexts face resource exhaustion risk. If an attacker sends crafted YAML payloads to an endpoint that parses untrusted input, the targeted service can experience high CPU spikes, slow response times, or complete unavailability. In cloud environments with auto-scaling, repeated attacks could inflate operational costs. Applications that parse YAML from external sources—such as configuration management tools, CI/CD pipelines, or API gateways—are especially at risk. The high CVSS score (7.5) reflects the ease of exploitation and significant availability impact.

Affected systems

Any system running nodeca js-yaml versions 3.0.0 through 3.14.x or 4.0.0 through 4.2.x is vulnerable. This includes Node.js applications, Electron apps, and browser-based tools that bundle js-yaml. Particular concern attaches to services that accept YAML input from untrusted sources without strict resource limits. Check your application dependencies and lock files (package-lock.json, yarn.lock) to identify vulnerable versions in your supply chain.

Exploitability

Exploitation requires only network access and the ability to send a crafted YAML payload to the vulnerable parser—no authentication or user interaction needed. The attack is trivial to execute: an attacker simply needs to construct a YAML document with nested merge keys and send it to a parsing endpoint. Because the vulnerability stems from algorithmic inefficiency rather than memory corruption or code injection, it does not lead to code execution or data breach, but directly impacts availability. The attack surface is broad for any public-facing service parsing YAML.

Remediation

Upgrade js-yaml to version 3.15.0 or later (for the 3.x branch) or version 4.3.0 or later (for the 4.x branch). Verify the upgrade in your lock files and re-run your dependency tests. If immediate patching is not feasible, implement protective measures: (1) enforce strict input size limits on YAML payloads, (2) add request timeouts to parsing operations, (3) use resource quotas or rate limiting on parsing endpoints, and (4) avoid parsing YAML from untrusted sources if possible.

Patch guidance

Consult the nodeca js-yaml repository and official advisory for the exact upgrade path for your version. The fix is available in js-yaml 3.15.0 and 4.3.0+. Use npm or yarn to update: verify against the vendor advisory that your target version resolves CVE-2026-59869. Test your application after upgrade to ensure no breaking changes in YAML parsing behavior, particularly if you rely on merge-key semantics.

Detection guidance

Monitor CPU usage spikes correlated with YAML parsing operations. Log and alert on unusually large or complex YAML payloads sent to parsing endpoints. If available, enable debug logging in js-yaml to observe merge-key processing. Intrusion detection systems can watch for repeated submission of pathological YAML patterns. In application performance monitoring (APM) tools, track parse latency and CPU time per request; anomalous increases warrant investigation. Combine with network-level rate limiting to catch brute-force DoS attempts.

Why prioritize this

This vulnerability merits prompt attention due to its high CVSS score (7.5), ease of exploitation, and broad applicability across Node.js ecosystems. Although it does not enable code execution, availability attacks can be as damaging as data breaches in cloud-native and SaaS environments. js-yaml is a foundational library in many dependency chains, making widespread exposure likely. Organizations should prioritize patches for externally-facing services first, then move to internal tools that parse untrusted YAML.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: (1) network-accessible attack vector (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), (2) complete availability impact (A:H) on the affected service, and (3) no confidentiality or integrity compromise. The attack complexity is low (AC:L), meaning the payload is straightforward to craft. This score appropriately captures the severity for availability-critical systems, though the lack of code execution potential keeps it below critical thresholds.

Frequently asked questions