CVE-2026-73643

js-yaml versions 5.0.0–5.2.2 expose a denial-of-service via exponential parsing time when loading untrusted YAML. In src/parser/parser.ts, readFlowCollection can double-parse nested flow sequences, causing O(2^n) work and potential CPU exhaustion for inputs under 200 bytes. Fixed in version 5.2.2...