{"id":"EUVD-2026-42302","revision":"c6f76d2b1bc542cd97a4e6539eae9615","records":[{"revision":"c6f76d2b1bc542cd97a4e6539eae9615","observedAt":"2026-11-07T13:25:46.759+00:00","statement":{"source":"euvd","id":"EUVD-2026-42302","aliases":["CVE-2026-59868","GHSA-g796-fgmg-93mv"],"title":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each…","description":"js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","https://github.com/nodeca/js-yaml/releases/tag/5.2.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42302","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 3:18:19 PM","dateUpdated":"Jul 9, 2026, 1:42:54 PM"},"relatedAdvisories":[{"id":"RHSA-2026:7655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-2950","CVE-2026-45149","CVE-2026-45736","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:34478","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:35272","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:34975","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-8286","CVE-2026-8458","CVE-2026-8924","CVE-2026-8925","CVE-2026-8926","CVE-2026-8927","CVE-2026-8932","CVE-2026-9079","CVE-2026-9080","CVE-2026-9546","CVE-2026-9547","CVE-2026-11352","CVE-2026-11564","CVE-2026-11586","CVE-2026-11856","CVE-2026-12064","CVE-2026-14683","CVE-2026-14684","CVE-2026-14685","CVE-2026-14686","CVE-2026-15187","CVE-2026-38969","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:61783","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2024-29180","CVE-2026-1965","CVE-2026-3783","CVE-2026-5704","CVE-2026-6322","CVE-2026-6653","CVE-2026-8286","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-14164","CVE-2026-15588","CVE-2026-18477","CVE-2026-18508","CVE-2026-41991","CVE-2026-41992","CVE-2026-45409","CVE-2026-45623","CVE-2026-54284","CVE-2026-54371","CVE-2026-56434","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58055","CVE-2026-59868","CVE-2026-59869","CVE-2026-59893","CVE-2026-60005","CVE-2026-67213","CVE-2026-67214","CVE-2026-71491","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844"]},{"id":"RHSA-2026:26994","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-45491","CVE-2026-45591","CVE-2026-45736","CVE-2026-59724","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:33866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-13149","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-53550","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:9455","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-2950","CVE-2026-8723","CVE-2026-45149","CVE-2026-48615","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-59868","CVE-2026-59870"]},{"id":"RHSA-2026:7378","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2025-55130","CVE-2025-55131","CVE-2025-55132","CVE-2025-59464","CVE-2026-2950","CVE-2026-6734","CVE-2026-9675","CVE-2026-9678","CVE-2026-9697","CVE-2026-45149","CVE-2026-48615","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-59868","CVE-2026-59870"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42302","identifiers":["EUVD-2026-42302","CVE-2026-59868","GHSA-g796-fgmg-93mv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}