The flaw lies in js‑yaml's parser where a nested flow‑sequence entry is parsed twice, leading to an exponential O(2^n) workload. When the application calls load() or loadAll() on malicious YAML that contains a nested flow‑sequence under 200 bytes, the parser can keep a CPU core busy for minutes, block the Node.js event loop and stall the entire process. This results in a denial of service to all users of the affected application, without giving the attacker any code execution or data exfiltration capability. The weakness is identified as CWE‑407, a “Resource Exhaustion” flaw.

The vulnerability affects nodeca’s js‑yaml library in versions 5.0.0 through 5.2.1. Versions 5.2.2 and later contain the fix and are safe to use. Any Node.js application that loads YAML data via load() or loadAll() and depends on a vulnerable js‑yaml release is at risk.

The CVSS score of 7.5 classifies this as a high‑severity risk. There is currently no EPSS score available and the issue is not listed in the CISA KEV catalog. Because the attack exploits a parsing bug triggered by untrusted YAML input, the most likely vector is an application that accepts user‑supplied YAML files or strings. An attacker can craft a short payload (under 200 bytes) that induces the exponential slowdown; no additional privileges or network access are required beyond the normal ability to deliver YAML content to the application.