A crafted YAML document can exploit the merge-key processing in js‑yaml prior to version 4.2.0 by repeating the same alias many times in a merge sequence. The resulting algorithmic behavior is quadratic with respect to the input size, leading to CPU exhaustion that blocks the Node.js worker/event loop for seconds even with a relatively small payload. This causes a denial of service to the application.

The vulnerability affects the js‑yaml library from nodeca, any installation of js‑yaml older than version 4.2.0. Applications that use js‑yaml to parse untrusted YAML input are at risk, regardless of the host operating system or Node.js runtime version.

The CVSS score of 5.3 indicates moderate severity, but the lack of an EPSS score means the current exploit probability is undetermined. The issue is not listed in CISA KEV. An attacker would need to supply a malicious YAML payload to a code path that calls the yaml loader; the potential attack vector is through user-provided data, configuration files, or any inbound YAML content that gets parsed without validation.