Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 js-yaml Denial of Service (Algorithmic Complexity), #CVE-2026-59868 (MEDIUM) -DC-Jul2026-1107 https://dailycve.com/js-yaml-denial-of-service-algorithmic-complexity-cve-2026-59868-medium-dc-jul2026-1107/
Post summary
The text announces a new CVE for js-yaml that triggers a denial of service via algorithmic complexity, with a medium severity rating, but no exploits, patches, or PoC details are noted.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nodeca | js-yaml | - | node.js | - |