Description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
Published: 2026-07-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the grow quadratically with the size of the YAML document. Feeding a large or specially crafted YAML file interruption. This inefficient parsing is identified by CWE‑407, and related to CWE‑1333 in terms of resource consumption loops.

Affected Systems

Nodeca js‑yaml versions from 5.0.0 up to, but not including, 5.2.0 are vulnerable; the issue is fixed in 5.2.0 and later. The vulnerability is reflected in the RedHat Hummingbird component, indicating that systems incorporating this component are also impacted.

Risk and Exploitability

The CVSS score of 5.3 classifies the issue as moderate severity. An EPSS score of < 1% indicates a low but non‑zero chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw by supplying specially crafted YAML documents to any running service that parses external YAML input with merge key support enabled, potentially overloading CPU resources and causing service degradation or interruption.

Generated by OpenCVE AI on July 26, 2026 at 17:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade js‑yaml to version 5.2.0 or later
  • Disable merge key support in js‑yaml when parsing external YAML to prevent quadratic CPU usage
  • Audit existing YAML data for merge key chains and sanitize or constrain input before parsing

Generated by OpenCVE AI on July 26, 2026 at 17:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g796-fgmg-93mv js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
History

Fri, 10 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-1333
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Nodeca
Nodeca js-yaml
Vendors & Products Nodeca
Nodeca js-yaml

Wed, 08 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
Title js-yaml: YAML merge-key chains can force quadratic CPU consumption
Weaknesses CWE-407
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Nodeca Js-yaml
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-09T13:42:54.035Z

Reserved: 2026-07-07T15:41:53.607Z

Link: CVE-2026-59868

cve-icon Vulnrichment

Updated: 2026-07-09T13:42:46.163Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-08T15:18:19Z

Links: CVE-2026-59868 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T17:45:17Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity

  • CWE-407

    Inefficient Algorithmic Complexity