CVE-2026-59869 is a denial of service vulnerability in the js-yaml JavaScript YAML parser and dumper. The flaw allows a remote attacker to provide a crafted YAML document containing a chain of mappings with merge keys, which causes the parser to consume excessive CPU resources. This leads to a denial of service condition on affected systems. Red Hat products that utilize js-yaml to process untrusted YAML input, including Thingsboard versions prior to 4.3.1.3-r4 and Red Hat Hardened Images with nodejs26 packages, are affected. The vulnerability is rated Important by Red Hat and has a CVSS v3 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A patch is available in Thingsboard 4.3.1.3-r4 and corresponding updated Red Hat packages. Mitigation involves restricting processing of untrusted YAML documents, implementing input validation and sanitization, and limiting network access to YAML parsing services.

The vulnerability allows remote attackers to cause a denial of service by consuming excessive CPU resources when processing specially crafted YAML documents. This can disrupt availability of affected applications and services without requiring authentication or complex attack vectors. No confidentiality or integrity impacts are reported.

A patch is available in Thingsboard version 4.3.1.3-r4 and updated Red Hat Hardened Images packages (e.g., nodejs26-26.4.0-1.4.hum1). Users should apply these updates to remediate the vulnerability. Additionally, restrict processing of untrusted YAML input by applications relying on js-yaml, implement robust input validation and sanitization for YAML data from untrusted sources, and consider limiting network access to YAML parsing services to trusted clients via firewall rules.