CVE-2026-59869

{
  "id": "CVE-2026-59869",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T16:16:33.423",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0."
    },
    {
      "lang": "es",
      "value": "js-yaml es un analizador y volcador YAML de JavaScript. Desde la versión 3.0.0 hasta antes de la 3.15.0 y desde la 4.0.0 hasta antes de la 4.3.0, js-yaml puede consumir tiempo de CPU cuadrático al analizar un documento cuyo tamaño crece solo linealmente cuando una cadena de mapeos utiliza claves de fusión donde cada mapeo fusiona el anterior. Este problema está solucionado en las versiones 3.15.0 y 4.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nodeca",
          "product": "js-yaml",
          "versions": [
            {
              "version": ">= 3.0.0, < 3.15.0",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0, < 4.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T15:14:16.302841Z",
          "id": "CVE-2026-59869",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndExcluding": "3.15.0",
              "matchCriteriaId": "F0303A0E-076A-425B-9746-6C685213D721"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.3.0",
              "matchCriteriaId": "90F8FD99-9730-49E7-B8AC-97BBF4658327"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}