StackRadar

CVE-2026-53550

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
32nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
457
of 17,787 indexed, latest versions
Container images
453
deployed by those charts
Fix available
1 of 2
affected packages

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Carried by container images the latest versions of 457 of 17,787 indexed charts deploy, on 453 images.

Affected packageAffected versionsFixed inImages
js-yamlnpm1.0.3, 3.5.5, 3.6.1, 3.7.0+11 more3.15.0, 4.2.0453
node-js-yamldeb4.1.0+dfsg+~4.0.5-7no fix listed2
OSV records
DEBIAN-CVE-2026-53550GHSA-h67p-54hq-rp68UBUNTU-CVE-2026-53550

Charts affected

457 by stars
ChartLatestAffected imagesRadar Score
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
js-yaml@3.14.1
3.15.0
kobotoolbox/kpi:2.022.24dbcacc01bccd4
js-yaml@3.13.1
3.15.0

Open the chart page →

18,518
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
js-yaml@4.1.0
4.2.0

Open the chart page →

7,776
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
js-yaml@4.1.0
4.2.0

Open the chart page →

2,703
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
js-yaml@3.13.1
3.15.0

Open the chart page →

24,549
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
thingsboard/tb-web-ui:3.6.0d388378062cc
js-yaml@4.1.0
4.2.0

Open the chart page →

14,568
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
thmmniii/fbs-qcm-frontend:v1.27.1a347f7f4d144
js-yaml@4.1.0
4.2.0

Open the chart page →

28,579
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
js-yaml@3.14.2
3.15.0

Open the chart page →

4,016
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
js-yaml@3.13.1
3.15.0

Open the chart page →

2,851
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
js-yaml@3.14.0
3.15.0

Open the chart page →

17,946
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
js-yaml@3.14.0
3.15.0

Open the chart page →

10,731
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
js-yaml@4.1.1
4.2.0

Open the chart page →

1,991
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
js-yaml@3.14.1
3.15.0

Open the chart page →

1,843
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
js-yaml@4.1.0
4.2.0

Open the chart page →

1,341
dawarichcogitriVerified publisher2.8.41 of 3See more

dawarich cogitri 2.8.4

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
freikin/dawarich:1.14.511826c67e4b1
js-yaml@4.1.0
node-js-yaml@4.1.0+dfsg+~4.0.5-7
4.2.0
no fix listed

Open the chart page →

5,650
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
js-yaml@3.13.1
3.15.0
ghcr.io/data-fair/data-fair:3cc9498b64b5b
js-yaml@3.14.1
3.15.0
ghcr.io/data-fair/metrics:0a8d40779eeae
js-yaml@3.14.1
3.15.0
ghcr.io/data-fair/notify:3c739b74dabb0
js-yaml@3.14.1
3.15.0
ghcr.io/data-fair/processings:15a9216989707
js-yaml@3.14.1
3.15.0
ghcr.io/data-fair/simple-directory:438a4f32fad82
js-yaml@3.14.1
3.15.0

Open the chart page →

38,424
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
js-yaml@3.14.1
3.15.0

Open the chart page →

5,057
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
js-yaml@4.1.1
4.2.0

Open the chart page →

7,518
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
js-yaml@3.14.1
3.15.0

Open the chart page →

3,925
domain-lockerdomain-locker0.2.81 of 3See more

domain-locker domain-locker 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
lissy93/domain-locker:latestd3c95edc0a8b
js-yaml@3.14.2
3.15.0

Open the chart page →

1,884
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/mongo:6.0.12646902910d6a
js-yaml@3.13.1
3.15.0

Open the chart page →

15,501
enbuildenbuildVerified publisher0.0.503 of 6See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
js-yaml@3.14.2
3.15.0
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
js-yaml@4.1.0
4.2.0
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
js-yaml@4.1.1
4.2.0

Open the chart page →

31,572
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
js-yaml@3.14.2
3.15.0

Open the chart page →

1,442
fastapi-microservice-appfast-api-microservice-app1.3.01 of 4See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

1 of the 4 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/mongo:7.0b6421fd6d1c5
js-yaml@3.13.1
3.15.0

Open the chart page →

9,619
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
js-yaml@3.14.1
3.15.0

Open the chart page →

2,519
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
js-yaml@1.0.3
3.15.0

Open the chart page →

4,260
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
js-yaml@4.1.0
4.2.0

Open the chart page →

15,717
magic-mirrorgeek-cookbookVerified publisher4.4.21 of 1See more

magic-mirror geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
js-yaml@3.14.1
3.15.0

Open the chart page →

4,405
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
js-yaml@4.0.0
4.2.0

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
js-yaml@3.14.1
3.15.0

Open the chart page →

7,801
zigbee2mqttgeek-cookbookVerified publisher9.4.21 of 1See more

zigbee2mqtt geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:1.19.15f9129b1ffbc
js-yaml@3.14.1
3.15.0

Open the chart page →

2,173
clickstackhdx-oss-v21.1.11 of 5See more

clickstack hdx-oss-v2 1.1.1

1 of the 5 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/mongo:5.0.32-focal3b6c281e1c08
js-yaml@3.13.1
3.15.0

Open the chart page →

4,750
pdc-portali4trustVerified publisher2.3.21 of 1See more

pdc-portal i4trust 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
i4trust/pdc-portal:2.0.03e77858e1219
js-yaml@4.0.0
4.2.0

Open the chart page →

2,723
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
js-yaml@4.1.0
4.2.0

Open the chart page →

15,749
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
js-yaml@3.14.1
3.15.0

Open the chart page →

17,365
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
js-yaml@3.14.1
3.15.0

Open the chart page →

3,369
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
js-yaml@4.1.0
4.2.0

Open the chart page →

5,234
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
js-yaml@3.14.1
3.15.0

Open the chart page →

3,143
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
js-yaml@4.1.0
4.2.0

Open the chart page →

20,424
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest836467a50792
js-yaml@4.1.0
4.2.0
chibisafe/chibisafe-server:latest3da4fcbc1a18
js-yaml@4.1.0
4.2.0

Open the chart page →

5,657
litlyxlitlyx0.2.02 of 5See more

litlyx litlyx 0.2.0

2 of the 5 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/mongo:8.0.11dca8d11fe467
js-yaml@3.13.1
3.15.0
litlyx/litlyx-dashboard:lateste64ff2d52385
js-yaml@4.1.1
4.2.0

Open the chart page →

7,915
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
js-yaml@3.14.1
3.15.0

Open the chart page →

5,941
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
js-yaml@4.1.0
4.2.0

Open the chart page →

13,763
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
js-yaml@4.1.1
4.2.0

Open the chart page →

2,576
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
js-yaml@4.1.0
4.2.0

Open the chart page →

2,473
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
js-yaml@3.13.1
3.15.0

Open the chart page →

5,833
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
js-yaml@4.1.0
4.2.0

Open the chart page →

2,084
pdf-editor-helmpdf-editor-web1.0.01 of 4See more

pdf-editor-helm pdf-editor-web 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
js-yaml@3.14.1
3.15.0

Open the chart page →

4,206
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
js-yaml@4.1.1
4.2.0

Open the chart page →

7,075
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
js-yaml@4.1.0
4.2.0
treskon/portrait-ui:DEV-lateste7970783bc8d
js-yaml@4.1.0
4.2.0

Open the chart page →

31,949
psa-restricted-patcherpsa-restricted-patcherVerified publisher0.10.11 of 1See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-53550.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
js-yaml@4.1.0
4.2.0

Open the chart page →

1,402

Container images carrying it

453 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
js-yaml@4.1.0
4.2.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
js-yaml@4.1.1
4.2.0
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
js-yaml@4.1.0
4.2.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.