CVE-2026-59870

Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.2.0

Description Support for the !!omap tag in YAML11 SCHEMA within src/tag/sequence/omap.ts uses the omapTag.addItem() function to perform a linear duplicate-key scan during every insertion. This results in O(n^2) CPU consumption, where the processing time grows quadratically relative to the input size, when yaml.load() parses a specially crafted ordered-map document.

Recommendations Update js-yaml to version 5.2.1.