[HIGH] Package: js-yaml Installed Version: 3.14.2 Vulnerability CVE-2026-59869 Severity: HIGH Fixed Version: 3.15.0, 4.3.0 Link: [CVE-2026-59869](https://avd.aquasec.com/nvd/cve-2026-59869) in package-lock.json

[begininvoke]

HIGH severity — found by an automated security scan.

Severity	high
Location	package-lock.json line 14288
Rule	CVE-2026-59869

What the scanner found

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Why it matters

The js-yaml library (3.14.2) is affected by CVE-2026-59869, which allows an attacker to trigger a quadratic CPU‑time attack when parsing YAML documents that contain a chain of merge keys. This can lead to denial‑of‑service (DoS) on servers that parse user-supplied YAML. The vulnerability is fixed in js‑yaml 3.15.0 and 4.3.0. Updating the package to a patched version eliminates the attack surface and restores normal CPU usage during parsing.

Suggested fix

--- a/package-lock.json
+++ b/package-lock.json
@@
-  "js-yaml": {
-    "version": "3.14.2",
-    "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-    "integrity": "sha512-...<old hash>...",
-    "requires": {
-      "lodash": "4.17.21"
-    }
-    // other fields omitted
-  }
+  "js-yaml": {
+    "version": "3.15.0",
+    "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+    "integrity": "sha512-...<new hash>...",
+    "requires": {
+      "lodash": "4.17.21"
+    }
+    // other fields remain unchanged
+  }

---

🔍 Found with RedGem — automated security scanning for source code.

This issue was generated automatically. If it is not useful, close it — and tell us why at code.redgem.net so we can improve the rules.