StackRadar

CVE-2021-43138

High

Advisory

Published 7 Apr 2022In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.033
88th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
116
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
1 of 1
affected package

Prototype Pollution in async

Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
asyncnpm2.0.1, 2.3.0, 2.4.0, 2.5.0+8 more2.6.4, 3.2.2106
OSV records
GHSA-fwr7-v2mv-hh25

Charts affected

116 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
async@2.6.3
2.6.4

Open the chart page →

9,203
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
async@3.2.1
3.2.2

Open the chart page →

4,285
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
async@2.5.0
2.6.4

Open the chart page →

10,732
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
async@2.6.3
2.6.4

Open the chart page →

5,251
carbonetes-analyzercarbonetes-analyzerVerified publisher1.0.61 of 1See more

carbonetes-analyzer carbonetes-analyzer 1.0.6

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
carbonetes/carbonetes-analyzer:1.0.31b9b93c9a37f
async@3.2.1
3.2.2

Open the chart page →

1,829
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:4.2.281bd96729c14
async@3.2.0
3.2.2

Open the chart page →

52,919
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
async@2.6.3
2.6.4

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
async@3.2.0
3.2.2

Open the chart page →

5,946
open5gsopen5gsVerified publisher2.3.41 of 5See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
async@2.5.0
2.6.4

Open the chart page →

9,261
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
taigaio/taiga-events:6.4.00bf2d24a57d9
async@3.2.0
3.2.2

Open the chart page →

7,255
hubotdecayofmind1.0.21 of 3See more

hubot decayofmind 1.0.2

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
decayofmind/hubot:3.3.21e18e92fe694
async@2.6.3
2.6.4

Open the chart page →

2,513
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
async@2.6.3
2.6.4

Open the chart page →

3,476
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
async@2.0.1
2.6.4

Open the chart page →

5,209
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
async@2.6.0
2.6.4

Open the chart page →

6,868
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
async@2.6.3
2.6.4
kobotoolbox/kpi:2.022.24dbcacc01bccd4
async@2.6.3
2.6.4

Open the chart page →

18,517
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
async@3.2.0
3.2.2

Open the chart page →

24,488
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
async@3.2.0
3.2.2

Open the chart page →

17,896
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
async@3.2.0
3.2.2

Open the chart page →

10,730
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
async@3.2.0
3.2.2

Open the chart page →

8,496
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
async@2.6.3
2.6.4

Open the chart page →

2,519
foundryvttgeek-cookbookVerified publisher3.4.21 of 1See more

foundryvtt geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
felddy/foundryvtt:0.8.36c5d90b90349
async@3.2.0
3.2.2

Open the chart page →

2,042
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
async@2.6.3
2.6.4

Open the chart page →

4,260
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
async@3.2.0
3.2.2

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
async@2.6.3
2.6.4

Open the chart page →

7,801
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
async@2.6.3
2.6.4

Open the chart page →

4,410
zigbee2mqttgeek-cookbookVerified publisher9.4.21 of 1See more

zigbee2mqtt geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:1.19.15f9129b1ffbc
async@3.2.0
3.2.2

Open the chart page →

2,173
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
async@2.6.3
2.6.4

Open the chart page →

5,940
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
async@2.5.0
2.6.4

Open the chart page →

5,300
scienceboxsciencebox0.0.71 of 17See more

sciencebox sciencebox 0.0.7

1 of the 17 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:4.5.08ced0a2f8073
async@3.2.0
3.2.2

Open the chart page →

6,587
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
async@2.6.3
2.6.4

Open the chart page →

7,517
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
async@3.2.0
3.2.2

Open the chart page →

9,148
restreamerutkuozdemirVerified publisher1.1.01 of 1See more

restreamer utkuozdemir 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
datarhei/restreamer:0.6.4655e12f9eeed
async@3.2.0
3.2.2

Open the chart page →

2,598
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
async@2.6.0
2.6.4

Open the chart page →

25,443
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
async@3.2.0
3.2.2

Open the chart page →

3,437
trifidappuio2.0.21 of 1See more

trifid appuio 2.0.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
zazuko/trifid:2.3.7054be137de70
async@2.6.3
2.6.4

Open the chart page →

2,783
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
async@2.0.1
2.6.4

Open the chart page →

18,277
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
async@3.2.0
3.2.2

Open the chart page →

5,806
rtorrent-floodbryanalves0.5.01 of 1See more

rtorrent-flood bryanalves 0.5.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jesec/flood:4.7.03d1d0bec117a
async@2.6.3
2.6.4

Open the chart page →

1,477
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
async@2.6.1
2.6.4

Open the chart page →

29,901
ethereumcloudnativeapp1.0.01 of 3See more

ethereum cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
async@2.6.0
2.6.4

Open the chart page →

27,417
hubotcloudnativeapp0.0.11 of 1See more

hubot cloudnativeapp 0.0.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
minddocdev/hubot:0.1.96c60b11a4fa7
async@2.6.1
2.6.4

Open the chart page →

2,580
kube-slackcloudnativeapp1.0.01 of 1See more

kube-slack cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
willwill/kube-slack:v4.1.1d443017aae98
async@2.6.1
2.6.4

Open the chart page →

1,937
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
async@2.6.3
2.6.4

Open the chart page →

25,456
maildevcnieg1.1.11 of 1See more

maildev cnieg 1.1.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
cnieg/maildev:v1.1.998ee05668915
async@3.1.0
3.2.2

Open the chart page →

2,449
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
async@2.6.3
2.6.4

Open the chart page →

12,907
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
async@2.0.1
2.6.4

Open the chart page →

5,209
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
async@2.6.3
2.6.4

Open the chart page →

3,744
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
async@2.6.3
2.6.4

Open the chart page →

3,260
iotagent-ulfiware0.1.21 of 1See more

iotagent-ul fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
fiware/iotagent-ul:1.14.0fe11f55a926d
async@2.6.2
2.6.4

Open the chart page →

3,337
floodgeek-cookbookVerified publisher6.4.21 of 1See more

flood geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jesec/flood:4.6.060bd59cfb4eb
async@2.6.3
2.6.4

Open the chart page →

2,000

Container images carrying it

106 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
async@2.6.3
2.6.4
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
async@2.6.3
2.6.4
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
async@3.2.1
3.2.2
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
async@3.1.1
3.2.2
1
quay.io/wekan/wekan:v5.65cb17600883a3
async@3.2.1
3.2.2
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
async@2.6.0
2.6.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.