CVE-2026-53550
CVE Details
Visit the official vulnerability details page for CVE-2026-53550 to learn more.
Initial Publication
06/22/2026
Last Update
07/09/2026
Third Party Dependency
js-yaml
NIST CVE Summary
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.
CVE Severity
Our Official Summary
Investigation is ongoing to determine how this vulnerability affects our products.
Status
Analyzed
Affected Products & Versions
| Version | PaletteAI | PaletteAI VerteX |
|---|---|---|
| 1.1.8 | ⚠️ Impacted | ⚠️ Impacted |
Revision History
No revisions available.