Name: CVE-2026-59869: Inefficient Algorithmic Complexity
Creator: Rapid7
Published: 2026-07-08T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-59869, CWE-407, CVSS 7.5, EPSS 0.00585

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Atlassian Jira	—	Upgrade to the latest version of Atlassian JIRA	Sep 16, 2026	Sep 15, 2026
Redhat_linux	—	Upgrade automation-gateway-proxy-debugsourceUpgrade python3.12-sqlparseUpgrade automation-gateway-serverUpgrade automation-hubUpgrade python3.12-django-ansible-base+channel_authUpgrade receptor-debuginfoUpgrade automation-controllerUpgrade rh-podman-desktopNo solution existsUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-eda-controller-baseUpgrade python3.12-gitpythonUpgrade automation-gateway-proxy-serverUpgrade python3.12-galaxy-ngUpgrade receptor-debugsourceUpgrade automation-controller-uiUpgrade python3.12-django-ansible-base+authenticationUpgrade python3.12-django-ansible-base+rest_filtersUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-eda-controller-base-servicesUpgrade automation-eda-controller-event-stream-servicesUpgrade automation-gateway-proxyUpgrade python3.12-django-ansible-base+rbacUpgrade automation-controller-serverUpgrade automation-controller-cliUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-controller-venv-towerUpgrade aap-metrics-utilityUpgrade receptorUpgrade automation-gatewayUpgrade receptorctlUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+api_documentationUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-gateway-configUpgrade python3-sqlparseUpgrade automation-eda-controllerUpgrade automation-platform-uiUpgrade python3.12-django-ansible-base	Aug 24, 2026	Jul 8, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence