js-yaml is a human-friendly data serialization language.
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and the parser rewinds to parse that entry a second time as the key. An attacker can exhaust CPU and block the Node event loop by supplying a small YAML document, under 200 bytes, with deeply nested flow sequences of key: value entries, since the re-parsing makes the work grow as O(2^n) in nesting depth. Exploitation occurs under the default configuration when the application parses untrusted YAML with load() or loadAll(), and needs no special schema, anchors, aliases, or merge keys.