CVE-2026-59869 is a denial of service vulnerability in the js-yaml JavaScript YAML parser and dumper. It occurs when a remote attacker provides a specially crafted YAML document containing a chain of mappings with merge keys, causing the parser to consume excessive CPU resources. This vulnerability affects Red Hat Hardened Images RPMs, specifically nodejs24 packages. Red Hat has issued updated RPMs to fix this issue. The vulnerability has a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network attack vector, low complexity, no privileges or user interaction required, and high availability impact. The vulnerability is tracked under multiple CWEs including CWE-606 (Unchecked Input for Loop Condition).

The vulnerability allows a remote attacker to cause a denial of service by consuming excessive CPU resources during YAML parsing, potentially disrupting services that process untrusted YAML input. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported. The issue affects Red Hat Hardened Images RPMs using nodejs24 and js-yaml components.

A patch is available from Red Hat as updated nodejs24 RPMs (version 24.18.0-0.3.hum1). Users should apply these updates promptly. Additionally, to reduce exposure, restrict processing of untrusted YAML documents by applications using js-yaml, implement input validation and sanitization for YAML data from untrusted sources, and limit network access to YAML-parsing services to trusted clients or networks. Red Hat provides official advisories and update instructions at https://access.redhat.com/errata/RHSA-2026:38236.