AIKIDO-2026-384204

TL;DR

js-yaml 5.x introduces YAML11_SCHEMA support with the !!omap (ordered map) tag. The addItem handler for !!omap performs a linear scan of all previously inserted entries to detect duplicate keys on every insertion, producing O(n^2) parse time for a document with n omap entries. An attacker who supplies a small crafted YAML document to an application calling yaml.load() with { schema: YAML11_SCHEMA } can stall the Node.js event loop for many seconds, resulting in denial of service. The fix replaces the per-insertion linear scan with an O(1) Set-based duplicate check.