Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-08T15:13:20
js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.
A flaw was found in js-yaml, a JavaScript YAML (YAML Ain't Markup Language) parser. An attacker could exploit this by providing a specially crafted YAML ordered-map document. This could lead to excessive CPU consumption, resulting in a denial of service (DoS) for applications processing the malicious YAML input.
js-yaml versions 5.0.0 through 5.2.0 are vulnerable to a denial of service via the omapTag.addItem() O(n^2) duplicate-key scan when parsing crafted YAML ordered-map documents with the YAML11_SCHEMA. This affects yaml.load() calls using that schema. Fixed in 5.2.1.
Avoid using the YAML11_SCHEMA when parsing untrusted YAML input, or upgrade to js-yaml 5.2.1 or later. Applications using the default schema (CORE_SCHEMA) are not affected.
Red Hat Hardened Images
2026-06-18T00:00:00Z
RHSA-2026:26994
dotnet8-0-main-8.0.128-1.hum1
Red Hat Hardened Images
2026-06-30T00:00:00Z
RHSA-2026:33866
nodejs26-main-26.4.0-1.3.hum1
Red Hat Hardened Images
2026-07-01T00:00:00Z
RHSA-2026:34478
nodejs24-main-24.18.0-0.2.hum1
Red Hat Hardened Images
2026-07-02T00:00:00Z
RHSA-2026:34975
rust-main-1.96.1-1.hum1
Red Hat Hardened Images
2026-07-03T00:00:00Z
RHSA-2026:35272
nodejs22-main-22.23.1-2.hum1
Red Hat Hardened Images
2026-04-10T00:00:00Z
RHSA-2026:7378
nodejs25-main-25.9.0-1.1.hum1
Red Hat Hardened Images
2026-04-11T00:00:00Z
RHSA-2026:7655
yarnpkg-main-1.22.22-18.1.hum1
Red Hat Hardened Images
2026-04-21T00:00:00Z
RHSA-2026:9455
nodejs20-main-20.20.2-1.hum1
Cryostat 4
Not affected
cryostat/cryostat-openshift-console-plugin-rhel9
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Not affected
grafana-infinity-datasource-npm
Cryostat 4
Not affected
js-yaml
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel9
Migration Toolkit for Containers
Not affected
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/console-mce-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Not affected
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Not affected
workload-availability/node-healthcheck-rhel9-operator
Node HealthCheck Operator
Not affected
workload-availability/node-remediation-console-rhel8
Node HealthCheck Operator
Not affected
workload-availability/node-remediation-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Not affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Not affected
js-yaml
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Not affected
automation-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-gateway
Red Hat Ansible Automation Platform 2
Not affected
automation-platform-ui
Red Hat build of Apache Camel for Spring Boot 4
Not affected
js-yaml
Red Hat build of Apache Camel - HawtIO 4
Not affected
js-yaml
Red Hat build of Apicurio Registry 3
Not affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Not affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Keycloak
Not affected
js-yaml
Red Hat Build of Podman Desktop
Not affected
rh-podman-desktop.git
Red Hat Ceph Storage 9
Not affected
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Not affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Not affected
js-yaml
Red Hat Developer Hub
Not affected
rhdh/rhdh-hub-rhel9
Red Hat Directory Server 11
Not affected
redhat-ds:11/389-ds-base
Red Hat Directory Server 12
Not affected
redhat-ds:12/389-ds-base
Red Hat Directory Server 13
Not affected
389-ds-base
Red Hat Discovery 2
Affected
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Not affected
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Not affected
rust
Red Hat Enterprise Linux 7
Not affected
subscription-manager
Red Hat Enterprise Linux 8
Not affected
grafana
Red Hat Enterprise Linux 8
Not affected
mozjs60
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 9
Not affected
gjs
Red Hat Enterprise Linux 9
Not affected
grafana
Red Hat Enterprise Linux 9
Not affected
pcs
Red Hat Enterprise Linux 9
Not affected
rust
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/disk-image-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rust
Red Hat JBoss Enterprise Application Platform 7
Not affected
js-yaml
Red Hat JBoss Enterprise Application Platform 8
Not affected
js-yaml
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
js-yaml
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/nmstate-console-plugin-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Not affected
devspaces/openvsx-rhel9
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Not affected
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Not affected
quay/quay-rhel8
Red Hat Quay 3
Not affected
quay/quay-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-remediations-rhel9
Red Hat Single Sign-On 7
Not affected
js-yaml
Red Hat Trusted Artifact Signer
Not affected
rhtas/rekor-search-ui-rhel9
Red Hat Trusted Artifact Signer
Not affected
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Not affected
rhtpa/rhtpa-trustification-service-rhel9
Self-service automation portal 2
Not affected
ansible-automation-platform/automation-portal
Self-service automation portal 2
Not affected
ansible-automation-platform/bootc-automation-portal-rhel9
streams for Apache Kafka 2
Not affected
js-yaml
streams for Apache Kafka 3
Not affected
js-yaml
https://www.cve.org/CVERecord?id=CVE-2026-59870
https://nvd.nist.gov/vuln/detail/CVE-2026-59870
https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
https://github.com/nodeca/js-yaml/releases/tag/5.2.1
https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm