---
id: CVE-2026-59870
title: js-yaml is a JavaScript YAML parser and dumper
summary: >-
  js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and
  5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts
  uses omapTag.addItem() to perform a linear duplicate-key scan on every
  insertion, cau…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
  - CWE-770
vendor: nodeca
product: js-yaml
affected:
  - 'js-yaml >= 5.0.0, < 5.2.1'
patched:
  - js-yaml 5.2.1
published: '2026-07-08'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T16:17:08.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59870'
references:
  - url: >-
      https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded
    label: security-advisories@github.com
  - url: >-
      https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
    label: security-advisories@github.com
  - url: >-
      https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a
    label: security-advisories@github.com
  - url: 'https://github.com/nodeca/js-yaml/releases/tag/3.15.1'
    label: security-advisories@github.com
  - url: 'https://github.com/nodeca/js-yaml/releases/tag/4.3.1'
    label: security-advisories@github.com
  - url: 'https://github.com/nodeca/js-yaml/releases/tag/5.2.1'
    label: security-advisories@github.com
  - url: 'https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm'
    label: security-advisories@github.com
  - url: 'https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59870'
  - url: 'https://github.com/advisories/GHSA-724g-mxrg-4qvm'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59870.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59870'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2498130'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59870'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34975'
  - url: 'https://access.redhat.com/errata/RHSA-2026:26994'
  - url: 'https://access.redhat.com/errata/RHSA-2026:9455'
  - url: 'https://access.redhat.com/errata/RHSA-2026:35272'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34478'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7378'
  - url: 'https://access.redhat.com/errata/RHSA-2026:33866'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7655'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.0074
epssPercentile: 0.54376
aliases:
  - GHSA-724g-mxrg-4qvm
ecosystem: npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-08T15:50:31.265965Z'
scores:
  nvd: 7.5
  cna: 7.5
  ghsa: 5.3
  vendor: 7.5
ingestedAt: '2026-07-20T21:43:15.197Z'
---

## Overview

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1.

## Affected

- `js-yaml >= 5.0.0, < 5.2.1`

## Remediation

Upgrade past the affected range:

- `js-yaml 5.2.1`

## Package advisory (CVE-2026-59870)

Affected packages:

- `js-yaml >= 5.0.0, <= 5.2.0`

Patched in:

- `js-yaml 5.2.1`

Source: https://github.com/advisories/GHSA-724g-mxrg-4qvm

## Vendor advisories

- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)
- **RHSA-2026:26994** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:26994)
- **RHSA-2026:9455** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:9455)
- **RHSA-2026:35272** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:35272)
- **RHSA-2026:34478** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:34478)
- **RHSA-2026:7378** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7378)
- **RHSA-2026:33866** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33866)
- **RHSA-2026:7655** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:7655)
- **Red Hat VEX** · Important · affected: Red Hat Discovery 2 · no fix planned: Red Hat Discovery 2 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59870.json)