Js‑yaml, a JavaScript YAML parser and dumper, contains a flaw that causes the parser to consume quadratic amounts of CPU time when processing documents that use a chained merging of mappings. The flaw arises only when merge keys are enabled and the document contains a sequence where each mapping merges the previous one. As a result, a YAML file whose size grows linearly can lead to an exponential growth in processing time, exhausting CPU resources and potentially rendering the service unavailable.

Nodeca js‑yaml versions from 5.0.0 up to, but not including, 5.2.0 are affected. Systems that run RedHat’s Hummingbird component are also impacted.

The CVSS score of 5.3 indicates a moderate severity issue. Its EPSS score of < 1 % reflects a low but non‑zero probability of exploitation, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw by supplying a specially crafted YAML document to any running service that parses external YAML with merge key support enabled, thereby causing CPU exhaustion and service degradation.