This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-59869 →

DEBIAN-CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a d...

Original description

The description as published by the source.

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 node-js-yaml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 node-js-yaml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 node-js-yaml

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0+~4.0.9-2"}]}]

References

advisory security-tracker.debian.org