CVE-2026-59868

Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.1.x

Description When merge keys are enabled, the software is susceptible to a Denial of Service (DoS) due to algorithmic complexity. Specifically, the parser can spend quadratic CPU time processing a document that grows only linearly in size. This occurs when a chain of mappings is used where each mapping merges the previous one, forcing the loader to enumerate inherited keys repeatedly. This results in O(N^2) work for an O(N) input size.

Recommendations Update js-yaml to version 5.2.0. As a temporary mitigation, disable the use of merge keys during parsing.