StackRadar

CVE-2026-101906

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.004
32nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
85
of 17,966 indexed, latest versions
Container images
71
deployed by those charts
Fix available
1 of 1
affected package

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Carried by container images the latest versions of 85 of 17,966 indexed charts deploy, on 71 images.

Affected packageAffected versionsFixed inImages
axiosnpm1.15.0, 1.15.1, 1.15.2, 1.16.0+5 more1.20.071
OSV records
GHSA-mghh-pgcx-3jjj

Charts affected

85 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.421 of 1See more

n8n community-charts 1.24.42

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
n8nio/n8n:2.40.59f693fd55655
axios@1.18.0
1.20.0

Open the chart page →

1,230
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
axios@1.18.0
1.20.0

Open the chart page →

1,595
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
axios@1.18.1
1.20.0

Open the chart page →

250
actualbudgetcommunity-chartsVerified publisher1.9.41 of 1See more

actualbudget community-charts 1.9.4

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
axios@1.18.1
1.20.0

Open the chart page →

1,470
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
axios@1.15.0
1.20.0

Open the chart page →

3,440
velero-uiotwldVerified publisher0.16.01 of 1See more

velero-ui otwld 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
otwld/velero-ui:0.10.31c228d9ef71b
axios@1.18.1
1.20.0

Open the chart page →

1,719
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
axios@1.15.2
1.20.0

Open the chart page →

11,464
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
axios@1.19.0
1.20.0

Open the chart page →

3,626
n8nhelmforgeVerified publisher2.1.22 of 2See more

n8n helmforge 2.1.2

2 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.3fdce8f852ac7
axios@1.18.0
1.20.0
n8nio/runners:2.41.31522f8179b76
axios@1.18.0
1.20.0

Open the chart page →

1,443
docmosthelmforgeVerified publisher1.4.01 of 4See more

docmost helmforge 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
docmost/docmost:0.96.0b56947fcfd08
axios@1.18.1
1.20.0

Open the chart page →

4,260
redisinsightredisinsight-guiVerified publisher1.3.51 of 1See more

redisinsight redisinsight-gui 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
redis/redisinsight:3.8b5e19ee240ab
axios@1.16.0
1.20.0

Open the chart page →

1,337
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
axios@1.19.0
1.20.0

Open the chart page →

1,313
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
baserow/web-frontend:2.3.3566d24c7d9f5
axios@1.18.0
1.20.0

Open the chart page →

19,214
heimdallheimdallOfficialVerified publisher3.3.31 of 2See more

heimdall heimdall 3.3.3

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
mitre/heimdall2:release-latest06f6e72d416a
axios@1.19.0
1.20.0

Open the chart page →

2,359
ghostcloudpirates-ghostVerified publisher0.20.261 of 3See more

ghost cloudpirates-ghost 0.20.26

1 of the 3 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
library/ghost:6.64.0586821cfebac
axios@1.18.1
1.20.0

Open the chart page →

7,893
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
axios@1.18.1
1.20.0

Open the chart page →

1,965
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
axios@1.19.0
1.20.0

Open the chart page →

1,378
dbgateappscodeVerified publisher2026.3.301 of 1See more

dbgate appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.0-alpine287077002446
axios@1.17.0
1.20.0

Open the chart page →

909
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
axios@1.15.0
1.20.0

Open the chart page →

2,399
node-redcharts-derwitt-devVerified publisher2.1.21 of 1See more

node-red charts-derwitt-dev 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
nodered/node-red:5.0.7a649dd711d55
axios@1.19.0
1.20.0

Open the chart page →

383
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/data-fair/portals:18b621866ceb2
axios@1.18.1
1.20.0

Open the chart page →

40,598
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
axios@1.16.1
1.20.0

Open the chart page →

8,491
jellystatdjjudas21Verified publisher1.0.11 of 1See more

jellystat djjudas21 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.12e61c759ec706
axios@1.17.0
1.20.0

Open the chart page →

1,992
ghostgroundhog2k0.212.141 of 1See more

ghost groundhog2k 0.212.14

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
axios@1.18.1
1.20.0

Open the chart page →

2,467
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
axios@1.18.1
1.20.0

Open the chart page →

756
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
axios@1.19.0
1.20.0

Open the chart page →

1,746
actualbudgetm0nsterrr-actualbudgetVerified publisher2.10.01 of 1See more

actualbudget m0nsterrr-actualbudget 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
axios@1.18.1
1.20.0

Open the chart page →

1,470
plane-enterprisemakeplaneOfficialVerified publisher3.10.23 of 13See more

plane-enterprise makeplane 3.10.2

3 of the 13 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.0488a6684637c
axios@1.18.1
1.20.0
makeplane/silo-commercial:v3.3.027bf6bbf59bd
axios@1.18.1
1.20.0
makeplane/space-commercial:v3.3.03dba6a659fb9
axios@1.18.1
1.20.0

Open the chart page →

4,608
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
axios@1.16.1
1.20.0

Open the chart page →

3,221
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
axios@1.18.1
1.20.0

Open the chart page →

1,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
axios@1.15.2
1.20.0

Open the chart page →

34,115
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
axios@1.15.1
1.20.0

Open the chart page →

6,245
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
axios@1.15.2
1.20.0

Open the chart page →

4,240
activepiecesadnoctemVerified publisher0.6.01 of 1See more

activepieces adnoctem 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
activepieces/activepieces:0.91.058414dfc94c4
axios@1.18.0
1.20.0

Open the chart page →

1,533
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
axios@1.18.0
1.20.0

Open the chart page →

4,474
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
axios@1.18.1
1.20.0

Open the chart page →

1,875
alluredeckalluredeckVerified publisher0.24.01 of 2See more

alluredeck alluredeck 0.24.0

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/mkutlak/alluredeck-api:0.41.0fa429df90c68
axios@1.18.1
1.20.0

Open the chart page →

1,583
platform-uiappscodeVerified publisher2026.9.111 of 1See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
axios@1.15.0
1.20.0

Open the chart page →

751
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
axios@1.18.1
1.20.0

Open the chart page →

1,440
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
axios@1.16.0
1.20.0

Open the chart page →

23,711
dbgatedbgate-helm-chartVerified publisher0.1.81 of 1See more

dbgate dbgate-helm-chart 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.3f2dc7423ea88
axios@1.18.1
1.20.0

Open the chart page →

1,796
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

584
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

584
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

584
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
axios@1.19.0
1.20.0

Open the chart page →

2,136
node-reddjdl-charts0.33.01 of 1See more

node-red djdl-charts 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
nodered/node-red:latesta649dd711d55
axios@1.19.0
1.20.0

Open the chart page →

383
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
axios@1.19.0
1.20.0

Open the chart page →

1,323
azuriteemberstackVerified publisher1.0.221 of 1See more

azurite emberstack 1.0.22

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
axios@1.19.0
1.20.0

Open the chart page →

626
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
axios@1.15.0
1.20.0

Open the chart page →

2,082
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101906.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
axios@1.19.0
1.20.0

Open the chart page →

2,330

Container images carrying it

71 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
treskon/portrait-ui:DEV-lateste7970783bc8d
axios@1.15.2
1.20.0
1
twentycrm/twenty:latest:v2.41.047bcefe4e497
axios@1.19.0
1.20.0
1
twentycrm/twenty:v2.43.0b2b662b1bef1
axios@1.19.0
1.20.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
axios@1.17.0
1.20.0
1
veecode/devportal28d1bafed0cf
axios@1.19.0
1.20.0
1
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
axios@1.15.0
1.20.0
1
ghcr.io/cameri/nostream:mainc134ac2fa289
axios@1.18.0
1.20.0
1
ghcr.io/data-fair/portals:18b621866ceb2
axios@1.18.1
1.20.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
axios@1.18.0
1.20.0
1
ghcr.io/mkutlak/alluredeck-api:0.41.0fa429df90c68
axios@1.18.1
1.20.0
1
ghcr.io/platform-mesh/portal:v0.27.16a7ecd5a0dc2
axios@1.18.0
1.20.0
1
ghcr.io/seerr-team/seerr:v3.5.027602401178d
axios@1.15.0
1.20.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
axios@1.15.0
1.20.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
axios@1.18.1
1.20.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
axios@1.16.0
1.20.0
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
axios@1.19.0
1.20.0
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
axios@1.18.1
1.20.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
axios@1.15.0
1.20.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
axios@1.19.0
1.20.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
axios@1.19.0
1.20.0
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway:prodf8474a665b11
axios@1.19.0
1.20.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.