StackRadar

CVE-2026-101903

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
61
of 17,966 indexed, latest versions
Container images
53
deployed by those charts
Fix available
1 of 1
affected package

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Carried by container images the latest versions of 61 of 17,966 indexed charts deploy, on 53 images.

Affected packageAffected versionsFixed inImages
axiosnpm1.16.1, 1.17.0, 1.18.0, 1.18.1+1 more1.20.053
OSV records
GHSA-c29m-xwm3-cm6r

Charts affected

61 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.421 of 1See more

n8n community-charts 1.24.42

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
n8nio/n8n:2.40.59f693fd55655
axios@1.18.0
1.20.0

Open the chart page →

1,230
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
axios@1.18.0
1.20.0

Open the chart page →

1,595
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
axios@1.18.1
1.20.0

Open the chart page →

250
actualbudgetcommunity-chartsVerified publisher1.9.41 of 1See more

actualbudget community-charts 1.9.4

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
axios@1.18.1
1.20.0

Open the chart page →

1,470
velero-uiotwldVerified publisher0.16.01 of 1See more

velero-ui otwld 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
otwld/velero-ui:0.10.31c228d9ef71b
axios@1.18.1
1.20.0

Open the chart page →

1,719
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
axios@1.19.0
1.20.0

Open the chart page →

3,626
n8nhelmforgeVerified publisher2.1.22 of 2See more

n8n helmforge 2.1.2

2 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.3fdce8f852ac7
axios@1.18.0
1.20.0
n8nio/runners:2.41.31522f8179b76
axios@1.18.0
1.20.0

Open the chart page →

1,443
docmosthelmforgeVerified publisher1.4.01 of 4See more

docmost helmforge 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
docmost/docmost:0.96.0b56947fcfd08
axios@1.18.1
1.20.0

Open the chart page →

4,260
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
axios@1.19.0
1.20.0

Open the chart page →

1,313
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
baserow/web-frontend:2.3.3566d24c7d9f5
axios@1.18.0
1.20.0

Open the chart page →

19,214
heimdallheimdallOfficialVerified publisher3.3.31 of 2See more

heimdall heimdall 3.3.3

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
mitre/heimdall2:release-latest06f6e72d416a
axios@1.19.0
1.20.0

Open the chart page →

2,359
ghostcloudpirates-ghostVerified publisher0.20.261 of 3See more

ghost cloudpirates-ghost 0.20.26

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
library/ghost:6.64.0586821cfebac
axios@1.18.1
1.20.0

Open the chart page →

7,893
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
axios@1.18.1
1.20.0

Open the chart page →

1,965
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
axios@1.19.0
1.20.0

Open the chart page →

1,378
dbgateappscodeVerified publisher2026.3.301 of 1See more

dbgate appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.0-alpine287077002446
axios@1.17.0
1.20.0

Open the chart page →

909
node-redcharts-derwitt-devVerified publisher2.1.21 of 1See more

node-red charts-derwitt-dev 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
nodered/node-red:5.0.7a649dd711d55
axios@1.19.0
1.20.0

Open the chart page →

383
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
ghcr.io/data-fair/portals:18b621866ceb2
axios@1.18.1
1.20.0

Open the chart page →

40,598
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
axios@1.16.1
1.20.0

Open the chart page →

8,491
jellystatdjjudas21Verified publisher1.0.11 of 1See more

jellystat djjudas21 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.12e61c759ec706
axios@1.17.0
1.20.0

Open the chart page →

1,992
ghostgroundhog2k0.212.141 of 1See more

ghost groundhog2k 0.212.14

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
axios@1.18.1
1.20.0

Open the chart page →

2,467
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
axios@1.18.1
1.20.0

Open the chart page →

756
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
axios@1.19.0
1.20.0

Open the chart page →

1,746
actualbudgetm0nsterrr-actualbudgetVerified publisher2.10.01 of 1See more

actualbudget m0nsterrr-actualbudget 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
axios@1.18.1
1.20.0

Open the chart page →

1,470
plane-enterprisemakeplaneOfficialVerified publisher3.10.23 of 13See more

plane-enterprise makeplane 3.10.2

3 of the 13 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.0488a6684637c
axios@1.18.1
1.20.0
makeplane/silo-commercial:v3.3.027bf6bbf59bd
axios@1.18.1
1.20.0
makeplane/space-commercial:v3.3.03dba6a659fb9
axios@1.18.1
1.20.0

Open the chart page →

4,608
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
axios@1.16.1
1.20.0

Open the chart page →

3,221
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
axios@1.18.1
1.20.0

Open the chart page →

1,575
activepiecesadnoctemVerified publisher0.6.01 of 1See more

activepieces adnoctem 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
activepieces/activepieces:0.91.058414dfc94c4
axios@1.18.0
1.20.0

Open the chart page →

1,533
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
axios@1.18.0
1.20.0

Open the chart page →

4,474
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
axios@1.18.1
1.20.0

Open the chart page →

1,875
alluredeckalluredeckVerified publisher0.24.01 of 2See more

alluredeck alluredeck 0.24.0

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
ghcr.io/mkutlak/alluredeck-api:0.41.0fa429df90c68
axios@1.18.1
1.20.0

Open the chart page →

1,583
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
axios@1.18.1
1.20.0

Open the chart page →

1,440
dbgatedbgate-helm-chartVerified publisher0.1.81 of 1See more

dbgate dbgate-helm-chart 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.3f2dc7423ea88
axios@1.18.1
1.20.0

Open the chart page →

1,796
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

584
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

584
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

584
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

2,136
node-reddjdl-charts0.33.01 of 1See more

node-red djdl-charts 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
nodered/node-red:latesta649dd711d55
axios@1.19.0
1.20.0

Open the chart page →

383
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
axios@1.19.0
1.20.0

Open the chart page →

1,323
azuriteemberstackVerified publisher1.0.221 of 1See more

azurite emberstack 1.0.22

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
axios@1.19.0
1.20.0

Open the chart page →

626
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
axios@1.19.0
1.20.0

Open the chart page →

2,330
flanksource-uiflanksourceVerified publisher1.4.3201 of 1See more

flanksource-ui flanksource 1.4.320

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.320d952c2a774a2
axios@1.18.1
1.20.0

Open the chart page →

2,952
mission-controlflanksourceVerified publisher0.1.3381 of 8See more

mission-control flanksource 0.1.338

1 of the 8 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
axios@1.18.1
1.20.0

Open the chart page →

9,766
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
axios@1.18.1
1.20.0

Open the chart page →

2,978
strapihelmforgeVerified publisher2.3.151 of 3See more

strapi helmforge 2.3.15

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
axios@1.19.0
1.20.0

Open the chart page →

2,206
twentyhelmforgeVerified publisher1.0.31 of 5See more

twenty helmforge 1.0.3

1 of the 5 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.43.0b2b662b1bef1
axios@1.19.0
1.20.0

Open the chart page →

2,763
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
infisical/infisical:latest3365445909be
axios@1.18.1
1.20.0

Open the chart page →

3,223
cdashkitwareVerified publisher0.20.01 of 3See more

cdash kitware 0.20.0

1 of the 3 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
kitware/cdash:v5.4.0da5abe941506
axios@1.19.0
1.20.0

Open the chart page →

12,503
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
axios@1.18.0
1.20.0

Open the chart page →

1,595
nostreamnostream0.1.01 of 1See more

nostream nostream 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
ghcr.io/cameri/nostream:mainc134ac2fa289
axios@1.18.0
1.20.0

Open the chart page →

717
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-101903.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
axios@1.18.0
1.20.0

Open the chart page →

1,595

Container images carrying it

53 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0
4
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
axios@1.18.1
1.20.0
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
axios@1.19.0
1.20.0
3
actualbudget/actual-server:26.9.0552beab3dec8
axios@1.18.1
1.20.0
2
library/ghost:6.65.090592b712b6b
axios@1.18.1
1.20.0
2
n8nio/n8n:2.36.714c4285bc303
axios@1.18.0
1.20.0
2
nodered/node-red:5.0.7:latesta649dd711d55
axios@1.19.0
1.20.0
2
activepieces/activepieces:0.91.058414dfc94c4
axios@1.18.0
1.20.0
1
baserow/web-frontend:2.3.3566d24c7d9f5
axios@1.18.0
1.20.0
1
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
axios@1.19.0
1.20.0
1
cyfershepard/jellystat:1.1.12e61c759ec706
axios@1.17.0
1.20.0
1
dbgate/dbgate:7.2.0-alpine287077002446
axios@1.17.0
1.20.0
1
dbgate/dbgate:7.2.3f2dc7423ea88
axios@1.18.1
1.20.0
1
directus/directus:12.0.29c8470ea465c
axios@1.16.1
1.20.0
1
docmost/docmost:0.96.0b56947fcfd08
axios@1.18.1
1.20.0
1
evershop/evershop:latestd0823576f91b
axios@1.19.0
1.20.0
1
flanksource/incident-manager-ui:v1.4.320d952c2a774a2
axios@1.18.1
1.20.0
1
growthbook/growthbook:5.1.0c8a124f55dca
axios@1.18.1
1.20.0
1
growthbook/growthbook:latestcbf1bc59e9a9
axios@1.18.1
1.20.0
1
helmforge/strapi-base:5.52.270e9143d6d92
axios@1.19.0
1.20.0
1
infisical/infisical:latest:v0.165.602082bf13163
axios@1.18.1
1.20.0
1
infisical/infisical:latest3365445909be
axios@1.18.1
1.20.0
1
kitware/cdash:v5.4.0da5abe941506
axios@1.19.0
1.20.0
1
library/ghost:6.64.0586821cfebac
axios@1.18.1
1.20.0
1
library/ghost:6.65.0-alpine3.23fea3264f902e
axios@1.18.1
1.20.0
1
library/kibana:8.19.2235544f1ff28a
axios@1.19.0
1.20.0
1
makeplane/live-commercial:v3.3.0488a6684637c
axios@1.18.1
1.20.0
1
makeplane/silo-commercial:v3.3.027bf6bbf59bd
axios@1.18.1
1.20.0
1
makeplane/space-commercial:v3.3.03dba6a659fb9
axios@1.18.1
1.20.0
1
mitre/heimdall2:release-latest06f6e72d416a
axios@1.19.0
1.20.0
1
n8nio/n8n:2.25.7761374d4eb84
axios@1.16.1
1.20.0
1
n8nio/n8n:2.40.59f693fd55655
axios@1.18.0
1.20.0
1
n8nio/n8n:2.36.8cfe2704ff858
axios@1.18.0
1.20.0
1
n8nio/n8n:2.41.3fdce8f852ac7
axios@1.18.0
1.20.0
1
n8nio/runners:2.41.31522f8179b76
axios@1.18.0
1.20.0
1
nodered/node-red:5.0.410f40d0a83e7
axios@1.19.0
1.20.0
1
otwld/velero-ui:0.10.31c228d9ef71b
axios@1.18.1
1.20.0
1
outlinewiki/outline:1.10.1832051f039b4
axios@1.18.1
1.20.0
1
twentycrm/twenty:latest:v2.41.047bcefe4e497
axios@1.19.0
1.20.0
1
twentycrm/twenty:v2.43.0b2b662b1bef1
axios@1.19.0
1.20.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
axios@1.17.0
1.20.0
1
veecode/devportal28d1bafed0cf
axios@1.19.0
1.20.0
1
ghcr.io/cameri/nostream:mainc134ac2fa289
axios@1.18.0
1.20.0
1
ghcr.io/data-fair/portals:18b621866ceb2
axios@1.18.1
1.20.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
axios@1.18.0
1.20.0
1
ghcr.io/mkutlak/alluredeck-api:0.41.0fa429df90c68
axios@1.18.1
1.20.0
1
ghcr.io/platform-mesh/portal:v0.27.16a7ecd5a0dc2
axios@1.18.0
1.20.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
axios@1.18.1
1.20.0
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
axios@1.19.0
1.20.0
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
axios@1.18.1
1.20.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.