[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-59869":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T17:19:26.604Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":20,"aliases":21,"duplicate_of":9,"upstream":23,"downstream":24,"duplicates":41,"related":42,"reserved_at":9,"published_at":45,"modified_at":46,"state":47,"summary":48,"references_raw":55,"kevs":90,"epss":9,"epss_history":91,"metrics":92,"affected":100},"CVE-2026-59869","js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-407","Inefficient Algorithmic Complexity","An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.","weakness","Incomplete","Class","Low",[],[],[22],"GHSA-52cp-r559-cp3m",[],[25,27,29,31,33,35,37,39],{"_key":26},"DEBIAN-CVE-2026-59869",{"_key":28},"RHSA-2026:37532",{"_key":30},"RHSA-2026:37534",{"_key":32},"RHSA-2026:37577",{"_key":34},"RHSA-2026:38187",{"_key":36},"RHSA-2026:38236",{"_key":38},"RHSA-2026:38304",{"_key":40},"UBUNTU-CVE-2026-59869",[],[43],{"_key":44},"CGA-C3G9-FFX5-4C4G","2026-07-08T15:15:54.675Z","2026-07-09T15:14:29.753Z","PUBLISHED",{"cisa_kev":49,"cisa_ransomware":49,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":50,"severity_score":51,"severity_version":52,"severity_source":53,"severity_vector":54,"severity_status":47},false,"high",7.5,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",[56,63,68,72,76,80,85],{"url":57,"sources":58,"tags":60},"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",[53,59],"osv_npm",[61,62],"X Refsource CONFIRM","WEB",{"url":64,"sources":65,"tags":66},"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",[53,59],[67,62],"X Refsource MISC",{"url":69,"sources":70,"tags":71},"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",[53,59],[67,62],{"url":73,"sources":74,"tags":75},"https://github.com/nodeca/js-yaml/releases/tag/3.15.0",[53,59],[67,62],{"url":77,"sources":78,"tags":79},"https://github.com/nodeca/js-yaml/releases/tag/4.3.0",[53,59],[67,62],{"url":81,"sources":82,"tags":83},"https://nvd.nist.gov/vuln/detail/CVE-2026-59869",[59],[84],"Advisory",{"url":86,"sources":87,"tags":88},"https://github.com/nodeca/js-yaml",[59],[89],"PACKAGE",[],[],[93,98],{"source":53,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":94,"cvss_v4_0":9},{"baseScore":51,"baseSeverity":95,"vectorString":54,"impactScore":96,"exploitabilityScore":97},"HIGH",6,10,{"source":59,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":99,"cvss_v4_0":9},{"baseScore":51,"baseSeverity":9,"vectorString":54,"impactScore":96,"exploitabilityScore":97},[101,117],{"ecosystem":9,"name":102,"vendor":103,"product":102,"cpe_part":104,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":105},"js-yaml","nodeca","a",[106,113],{"version":107,"is_range":108,"range_type":53,"version_start":109,"version_start_type":110,"version_end":111,"version_end_type":112,"fixed_in":9},">= 3.0.0, \u003C 3.15.0",true,"3.0.0","including","3.15.0","excluding",{"version":114,"is_range":108,"range_type":53,"version_start":115,"version_start_type":110,"version_end":116,"version_end_type":112,"fixed_in":9},">= 4.0.0, \u003C 4.3.0","4.0.0","4.3.0",{"ecosystem":118,"name":102,"vendor":118,"product":102,"cpe_part":9,"purl_type":119,"purl_namespace":9,"purl_name":102,"source":9,"versions":120},"Npm","npm",[121,124],{"version":122,"is_range":108,"range_type":123,"version_start":109,"version_start_type":110,"version_end":111,"version_end_type":112,"fixed_in":9},"gte3_0_0_lt3_15_0","semver",{"version":125,"is_range":108,"range_type":123,"version_start":115,"version_start_type":110,"version_end":116,"version_end_type":112,"fixed_in":9},"gte4_0_0_lt4_3_0"]