Npm · Js-Yaml · CVE-2026-59870
**Name of the Vulnerable Software and Affected Versions**
js-yaml versions 5.0.0 through 5.2.0
**Description**
Support for the `!!omap` tag in `YAML11 SCHEMA` within `src/tag/sequence/omap.ts` uses the `omapTag.addItem()` function to perform a linear duplicate-key scan during every insertion. This results in O(n^2) CPU consumption, where the processing time grows quadratically relative to the input size, when `yaml.load()` parses a specially crafted ordered-map document.
**Recommendations**
Update js-yaml to version 5.2.1.