The vulnerability in js-yaml affects versions from 3.0.0 up to but not including 3.15.0 and from 4.0.0 up to but not including 4.3.0. It causes the parser to spend quadratic CPU time when processing YAML documents that use a chain of mappings with merge keys, where each mapping merges the previous one. This results in a denial of service condition due to high CPU usage. The vulnerability is resolved in versions 3.15.0 and 4.3.0. The affected Ubuntu package versions explicitly include 3.9.1+dfsg-1, 3.10.0+dfsg-1, and 3.13.1+dfsg-2.

An attacker can craft a YAML document that triggers excessive CPU consumption during parsing, leading to a denial of service condition. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade js-yaml to version 3.15.0 or later, or 4.3.0 or later, as these versions contain the fix for this vulnerability. The affected Ubuntu package versions should be updated accordingly. Patch status is confirmed by the vendor advisory indicating fixes in these versions.