Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-08T15:18:19
js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU time required to parse the document, resulting in a Denial of Service (DoS) for the affected system.
js-yaml versions 5.0.0 through 5.1.x are vulnerable to a denial of service. When merge keys ('<<') are enabled during YAML parsing, js-yaml re-merges the accumulated mapping into each subsequent mapping in a chain. A document consisting of a linear chain of mappings that each merge the previous one causes quadratic (O(n^2)) CPU consumption relative to input size, even though the document size itself grows only linearly. This can be triggered via yaml.load() on untrusted YAML input that uses merge keys. Fixed in js-yaml 5.2.0.
Upgrade to js-yaml 5.2.0 or later. Where an immediate upgrade is not possible, avoid parsing untrusted YAML documents that use merge keys ('<<'), or apply size and time limits when parsing untrusted YAML input.
Red Hat Hardened Images
2026-06-18T00:00:00Z
RHSA-2026:26994
dotnet8-0-main-8.0.128-1.hum1
Red Hat Hardened Images
2026-06-30T00:00:00Z
RHSA-2026:33866
nodejs26-main-26.4.0-1.3.hum1
Red Hat Hardened Images
2026-07-01T00:00:00Z
RHSA-2026:34478
nodejs24-main-24.18.0-0.2.hum1
Red Hat Hardened Images
2026-07-02T00:00:00Z
RHSA-2026:34975
rust-main-1.96.1-1.hum1
Red Hat Hardened Images
2026-07-03T00:00:00Z
RHSA-2026:35272
nodejs22-main-22.23.1-2.hum1
Red Hat Hardened Images
2026-04-10T00:00:00Z
RHSA-2026:7378
nodejs25-main-25.9.0-1.1.hum1
Red Hat Hardened Images
2026-04-11T00:00:00Z
RHSA-2026:7655
yarnpkg-main-1.22.22-18.1.hum1
Red Hat Hardened Images
2026-04-21T00:00:00Z
RHSA-2026:9455
nodejs20-main-20.20.2-1.hum1
Cryostat 4
Not affected
cryostat/cryostat-openshift-console-plugin-rhel9
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Not affected
grafana-infinity-datasource-npm
Cryostat 4
Not affected
js-yaml
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel9
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/console-mce-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-rhel9-operator
Node HealthCheck Operator
Not affected
workload-availability/node-remediation-console-rhel8
Node HealthCheck Operator
Not affected
workload-availability/node-remediation-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Not affected
js-yaml
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Not affected
automation-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-gateway
Red Hat Ansible Automation Platform 2
Not affected
automation-platform-ui
Red Hat build of Apache Camel for Spring Boot 4
Not affected
js-yaml
Red Hat build of Apache Camel - HawtIO 4
Not affected
js-yaml
Red Hat build of Apicurio Registry 3
Not affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Not affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Keycloak
Not affected
js-yaml
Red Hat Build of Podman Desktop
Not affected
rh-podman-desktop.git
Red Hat Ceph Storage 9
Not affected
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Not affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Not affected
js-yaml
Red Hat Developer Hub
Not affected
rhdh/rhdh-hub-rhel9
Red Hat Directory Server 11
Not affected
redhat-ds:11/389-ds-base
Red Hat Directory Server 12
Not affected
redhat-ds:12/389-ds-base
Red Hat Directory Server 13
Not affected
389-ds-base
Red Hat Discovery 2
Affected
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Not affected
rust
Red Hat Enterprise Linux 7
Not affected
subscription-manager
Red Hat Enterprise Linux 8
Not affected
grafana
Red Hat Enterprise Linux 8
Not affected
mozjs60
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 9
Not affected
gjs
Red Hat Enterprise Linux 9
Not affected
grafana
Red Hat Enterprise Linux 9
Not affected
pcs
Red Hat Enterprise Linux 9
Not affected
rust
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/disk-image-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rust
Red Hat JBoss Enterprise Application Platform 7
Not affected
js-yaml
Red Hat JBoss Enterprise Application Platform 8
Not affected
js-yaml
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
js-yaml
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/nmstate-console-plugin-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/openvsx-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Not affected
quay/quay-rhel8
Red Hat Quay 3
Not affected
quay/quay-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-remediations-rhel9
Red Hat Single Sign-On 7
Not affected
js-yaml
Red Hat Trusted Artifact Signer
Not affected
rhtas/rekor-search-ui-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Not affected
rhtpa/rhtpa-trustification-service-rhel9
Self-service automation portal 2
Not affected
ansible-automation-platform/automation-portal
Self-service automation portal 2
Not affected
ansible-automation-platform/bootc-automation-portal-rhel9
streams for Apache Kafka 2
Not affected
js-yaml
streams for Apache Kafka 3
Not affected
js-yaml
https://www.cve.org/CVERecord?id=CVE-2026-59868
https://nvd.nist.gov/vuln/detail/CVE-2026-59868
https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
https://github.com/nodeca/js-yaml/releases/tag/5.2.0
https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv