The vulnerability in js‑yaml arises from how the !!omap tag is parsed under YAML11_SCHEMA. Each insertion of an ordered‑map item triggers a linear duplicate‑key scan, leading to an overall O(n^2) CPU cost when yaml.load() processes a crafted document. An attacker can supply a YAML file with many ordered‑map entries to exhaust CPU resources, resulting in a denial‑of‑service condition. The flaw is characterized by CWE‑407 (Repetitive Processing) and CWE‑770 (Increased Resource Consumption), and no remote code execution or information disclosure paths are exposed.

The flaw affects the nodeca js‑yaml package, specifically versions beginning with 5.0.0 up to, but not including, 5.2.1. Any application or service that includes one of these versions—directly or through a dependency chain—operating in any JavaScript environment (Node.js, browser, etc.) is vulnerable if it processes YAML input with YAML11_SCHEMA support for the !!omap tag.

The CVSS score of 5.3 reflects a moderate severity, and the EPSS score, currently less than 1%, indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to supply a crafted YAML document to any code path that invokes yaml.load(); therefore the attack vector is likely local or through an application that accepts user‑supplied YAML. Although no publicly disclosed exploit code exists, the DoS impact could degrade service availability in production deployments if a high‑volume ordered‑map payload is delivered.