Resource exhaustion in js-yaml (npm) - CVE-2026-59869

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU136867

Resource exhaustion in js-yaml (npm) - CVE-2026-59869

Published: July 3, 2026


Vulnerability identifier: #VU136867
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59869
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the js-yaml parser when parsing YAML documents containing chained merge keys. A remote attacker can send a specially crafted YAML document to cause a denial of service.

The issue results in quadratic CPU consumption for input whose size grows only linearly.


Affected software

js-yaml (npm)
Event Processing
Maximo Application Suite - Visual Inspection Component
PowerVC
Bitbucket Data Center
Jira Software Data Center
Jira Service Management Data Center
Red Hat Advanced Cluster Security for Kubernetes
Red Hat OpenShift Container Platform

How to mitigate CVE-2026-59869

Install security update from vendor's website.

js-yaml (npm) - addressed in versions 3.15.0, 4.3.0
Event Processing - update to 1.5.5
Bitbucket Data Center - addressed in versions 9.4.23, 10.2.6, 10.4.2
Maximo Application Suite - Visual Inspection Component - update to 9.2.1
Jira Software Data Center - addressed in versions 10.3.24, 11.3.11
Jira Service Management Data Center - addressed in versions 10.3.24, 11.3.11
Red Hat Advanced Cluster Security for Kubernetes - update to 4.11.2
Red Hat OpenShift Container Platform - addressed in versions 4.20.31, 4.21.26

External References

Related Security Bulletins