The vulnerability in js-yaml 3.x and 4.x occurs in the resolveYamlOmap() function, which enforces uniqueness of keys in !!omap sequences by performing a linear scan (objectKeys.indexOf) inside a loop over each element. This results in O(n²) CPU complexity relative to the number of entries. Parsing a modestly sized YAML document with many !!omap entries can cause significant CPU consumption and block the Node.js event loop synchronously, leading to denial of service. The 5.x line fixed this by replacing the linear scan with a Set to track seen keys, improving performance to O(n). The fix was introduced in 5.2.1 but was not backported to 3.x or 4.x, so these legacy lines remain vulnerable.

An attacker can craft a YAML document with a large !!omap sequence to cause js-yaml 3.x or 4.x to consume excessive CPU and block the Node.js event loop synchronously. This results in denial of service for any service parsing untrusted YAML using these versions. The impact is availability-only, with no confidentiality or integrity loss. The attack requires no privileges or user interaction and can be triggered remotely via network input.

A patch is available in js-yaml 5.2.1 that fixes this vulnerability by replacing the linear scan with a Set to track keys, reducing CPU complexity to O(n). Users of the 3.x and 4.x lines should upgrade to at least 5.2.1 or later to receive the fix. Since the fix was not backported, continuing to use 3.x or 4.x leaves systems vulnerable. No vendor advisory indicates alternative mitigations or temporary fixes. Therefore, upgrading to a fixed version is the recommended remediation.