js-yaml versions 3.x and 4.x contain a quadratic CPU consumption vulnerability in the resolution of the !!omap YAML type. The vulnerability arises from a linear scan to enforce key uniqueness, causing CPU usage to grow quadratically with the number of entries. This can lead to denial of service by blocking the Node.js event loop during YAML parsing of attacker-controlled input. The issue is fixed in js-yaml 5.2.1 by using a Set to track keys, but this fix was not backported to the 3.x and 4.x lines.