The vulnerability CVE-2026-59869 is a denial of service (DoS) issue in the js-yaml library, a JavaScript YAML parser and dumper used by Red Hat Hardened Images RPMs, specifically nodejs25 packages. An attacker can exploit this by submitting a crafted YAML document with a chain of mappings using merge keys, which causes the parser to consume excessive CPU resources, resulting in a DoS condition. Red Hat has classified this vulnerability as Important and rated its impact as high availability impact with no confidentiality or integrity impact. The affected versions are nodejs25 packages >=25.0.0 and <25.9.0. The advisory does not indicate an official patch release yet, and Red Hat recommends mitigation by restricting untrusted YAML processing and applying input validation and network restrictions.

The vulnerability allows remote attackers to cause a denial of service by consuming excessive CPU resources when parsing specially crafted YAML documents. This can disrupt services that rely on js-yaml for YAML processing without requiring authentication or complex attack vectors. There is no impact on confidentiality or integrity, only availability is affected.

No official fix or patch is currently available for this vulnerability. To reduce exposure, restrict the processing of untrusted YAML documents by applications using js-yaml. Implement robust input validation and sanitization for all YAML data from untrusted sources. Additionally, limit network access to services that parse YAML content to trusted clients or networks using firewall rules. Monitor Red Hat advisories for updates regarding an official fix.