THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5p4m-2wfm-xmqj (high) — JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

[GHSA] GHSA-5p4m-2wfm-xmqj (high) — JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

medgithub_advisoriesPublished 2026-08-06

GHSA-5p4m-2wfm-xmqj Severity: high CVE: None

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x)

## Summary

`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with a linear scan (`objectKeys.indexOf(...)`) inside the per-element loop, making resolution

Indicators of compromise

CVE-2026-59870cve

Original source: https://github.com/advisories/GHSA-5p4m-2wfm-xmqj