CVE-2026-59870

{
  "id": "CVE-2026-59870",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T16:16:33.580",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. In v3 and v4, !!omap is active and exploitable by default. v5 doesn't use !!omap by default, and the chances of activating it are very low.This issue is fixed in 3.15.1, 4.3.1, and 5.2.1."
    },
    {
      "lang": "es",
      "value": "js-yaml es un analizador y volcador YAML de JavaScript. Versiones anteriores a la 3.15.1, 4.3.1 y 5.2.1, el soporte de YAML11_SCHEMA para la etiqueta !!omap en src/tag/sequence/omap.ts utiliza omapTag.addItem() para realizar un escaneo lineal de claves duplicadas en cada inserción, lo que provoca un consumo de CPU de O(n^2) cuando yaml.load() analiza un documento de mapa ordenado manipulado. En las versiones 3 y 4, !!omap está activo y es explotable por defecto. La versión 5 no utiliza !!omap por defecto, y las posibilidades de activarlo son muy bajas. Este problema se ha solucionado en la 3.15.1, 4.3.1 y 5.2.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nodeca",
          "product": "js-yaml",
          "versions": [
            {
              "version": ">= 5.0.0, < 5.2.1",
              "status": "affected"
            },
            {
              "version": ">= 3.0.0, < 3.15.1",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0, < 4.3.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T15:50:31.265965Z",
          "id": "CVE-2026-59870",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodeca:js-yaml:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.2.1",
              "matchCriteriaId": "364B7995-9A39-4BB4-92C4-B0D7A946F16B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nodeca/js-yaml/releases/tag/5.2.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}