js‑yaml is a popular JavaScript YAML parser that supports merge keys. The vulnerability disclosed as CVE‑2026‑59869 allows an attacker to craft a YAML document containing a chain of merge‑key mappings. Processing such a document causes the parser to perform quadratic CPU work as the document size grows only linearly, resulting in significant CPU exhaustion. This leads to denial‑of‑service conditions on the host running the parser, as the process can become unresponsive and may consume disproportionate system resources. The flaw is identified as a resource‑consumption weakness classified under CWE‑407 and, because input validation to guard against malicious use is missing, under CWE‑606.

The affected component is the js‑yaml library provided by nodeca. Any application that imports or requires js‑yaml in the vulnerable range—specifically versions 3.0.0 through 3.14.999 and 4.0.0 through 4.2.999—can be impacted when it deserializes untrusted YAML input. This includes web frameworks, APIs, configuration loaders, and other tools that depend on js‑yaml. The Red Hat Hummingbird product is noted as an instance that incorporates the library, but the issue primarily concerns the js‑yaml component itself.

The CVSS score of 7.5 positions this flaw in the high severity range. The EPSS score is reported as less than 1 %, indicating a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the supplied description, the attack vector is the delivery of a malicious YAML document; it is inferred that authentication is not required, as any input processed by the parser can trigger the flaw. Exploitation requires no special privileges; an attacker only needs to provide the crafted YAML to any application that utilizes the vulnerable js‑yaml library.