CVE-2026-59870High· 7.5▾ MidnightPoC availablejs-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, cau…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Exploit / PoC code exists
5.3 → 7.5
medium → high
0.4% → 0.7%
js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.
js-yaml >= 5.0.0, < 5.2.1Upgrade past the affected range:
js-yaml 5.2.1Affected packages:
js-yaml >= 5.0.0, <= 5.2.0Patched in:
js-yaml 5.2.1Source: https://github.com/advisories/GHSA-724g-mxrg-4qvm
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59868Medium· 5.3js-yaml is a JavaScript YAML parser and dumper
CVE-2026-84375High· 7.5js-yaml is a JavaScript YAML parser and dumper
CVE-2026-96640High· 8.2Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-114138High· 7.5Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
CVE-2026-112894High· 7.5Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-110755High· 7.5Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline