CVE-2026-110180
MediumAdvisory
Published 23 Oct 2026In the index since 24 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 4.8
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 111
- of 18,232 indexed, latest versions
- Container images
- 97
- deployed by those charts
- Fix available
- 1 of 1
- affected package
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
Carried by container images the latest versions of 111 of 18,232 indexed charts deploy, on 97 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| fast-urinpm | 3.1.3, 3.1.4, 3.1.5, 3.1.6+5 more | 3.1.9, 4.2.3 | 97 |
- OSV records
- GHSA-wjr9-j795-jxcr
Charts affected
111 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| n8ncommunity-chartsVerified publisher | 1.24.43 | 1 of 1See more | 1,888 |
| n8nopen-8gears | 2.1.1 | 1 of 1See more | 2,762 |
| backstagebackstageOfficialVerified publisher | 2.10.2 | 1 of 1See more | 1,490 |
| opensearch-dashboardsopensearch-project-helm-chartsVerified publisher | 3.9.0 | 1 of 1See more | 420 |
| penpotpenpotOfficialVerified publisher | 1.11.4 | 1 of 5See more | 5,188 |
| verdaccioverdaccio | 4.35.4 | 1 of 1See more | 64 |
| openclawopenclawVerified publisher | 1.118.2 | 1 of 2See more | 3,570 |
| budibasebudibase | 0.0.0-master | 1 of 7See more | 12,484 |
| zigbee2mqttandrenarchyVerified publisher | 9.44.0 | 1 of 1See more | 335 |
| n8nhelmforgeVerified publisher | 2.1.8 | 1 of 2See more | 1,358 |
| zigbee2mqttzigbee2mqtt | 2.14.2 | 1 of 2See more | 1,722 |
| docmosthelmforgeVerified publisher | 1.4.4 | 1 of 4See more | 4,969 |
| libredb-studiolibredb-studioOfficialVerified publisher | 0.1.102 | 1 of 1See more | 1,560 |
| backstagerhdh-chartVerified publisher | 4.0.1 | 1 of 2See more | 2,297 |
| heimdallheimdallOfficialVerified publisher | 3.3.3 | 1 of 2See more | 2,922 |
| karakeephelmforgeVerified publisher | 1.2.11 | 1 of 3See more | 11,431 |
| umamihelmforgeVerified publisher | 2.4.2 | 1 of 3See more | 2,206 |
| ghostcloudpirates-ghostVerified publisher | 0.20.32 | 1 of 3See more | 9,293 |
| flyte-binaryflyte | 2.0.52 | 1 of 4See more | 45,483 |
| flyte-coreflyte | 2.0.52 | 1 of 3See more | 1,003 |
| ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher | 2.0.2 | 1 of 3See more | 1,792 |
| home-assistanthome-assistantVerified publisher | 0.5.14 | 1 of 3See more | 4,129 |
| betterdb-monitorbetterdb-monitorOfficialVerified publisher | 0.51.1 | 1 of 1See more | 434 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 13,218 |
| gorules-brmsgorulesVerified publisher | 1.18.1 | 1 of 1See more | 336 |
| ghostgroundhog2k | 0.212.18 | 1 of 1See more | 2,159 |
| growthbookgrowthbook | 5.1.0 | 1 of 2See more | 1,554 |
| immichimmich-helmVerified publisher | 0.5.1 | 1 of 4See more | 10,531 |
| keycloak-reporterkeycloak-reporterVerified publisher | 1.4.17 | 1 of 1See more | 1,114 |
| n8nklicktippVerified publisher | 1.12.0 | 1 of 1See more | 577 |
| stackradarlockdepVerified publisher | 0.2.0 | 1 of 4See more | 6,001 |
| plane-enterprisemakeplaneOfficialVerified publisher | 3.10.12 | 3 of 13See more | 7,782 |
| observability-mcpobservability-mcpOfficialVerified publisher | 2.9.15 | 1 of 2See more | 68 |
| growthbookone-acre-fundVerified publisher | 0.3.0 | 1 of 3See more | 1,642 |
| openclawopenclaw-helm-chartVerified publisher | 1.0.70 | 1 of 3See more | 2,448 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 96,248 |
| immichsecustorVerified publisher | 2.0.12 | 1 of 1See more | 3,170 |
| supabasesupabse | 0.8.0 | 1 of 11See more | 56,496 |
| activepiecesadnoctemVerified publisher | 0.7.2 | 1 of 1See more | 2,151 |
| outlineadnoctemVerified publisher | 0.1.3 | 1 of 1See more | 1,757 |
| akeyless-gatewayakeyless-services-helmVerified publisher | 3.8.5 | 1 of 2See more | 1,589 |
| browserlessalekcVerified publisher | 1.3.3 | 1 of 1See more | 1,348 |
| zigbee2mqttalekcVerified publisher | 1.0.2 | 1 of 2See more | 108 |
| arith-tsarith-tsVerified publisher | 1.1.0 | 1 of 1See more | 29 |
| immichbear | 0.1.1 | 1 of 2See more | 8,756 |
| bluerange-mosquittobluerangeOfficialVerified publisher | 1.1.0 | 1 of 1See more | 354 |
| openmctbryopsida | 0.1.1 | 1 of 1See more | 1,500 |
| openclawcabrera-evil-chartsVerified publisher | 0.1.1 | 1 of 1See more | 2,496 |
| dv-podcharonOfficialVerified publisher | 0.20.0 | 1 of 5See more | 5,068 |
| ghostchart-ghost | 0.1.7 | 1 of 2See more | 1,377 |
Container images carrying it
97 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| decisionrules/ | 6f6d024a87b8 | fast-uri | 3.1.9 | 3 |
| koenkk/ | addbfb08fcef | fast-uri | 3.1.9 | 3 |
| opensearchproject/ | 4bdb8ded547c | fast-uri | 3.1.9 | 3 |
| verdaccio/ | d394c36d62a6 | fast-uri | 3.1.9 | 3 |
| epamedp/ | ebc7ca162d87 | fast-uri | 3.1.9 | 2 |
| homebridge/ | d2370beb6a02 | fast-uri | 4.2.3 | 2 |
| infisical/ | dbc5be2079b6 | fast-uri | 3.1.9 | 2 |
| koenkk/ | fef0de769dcd | fast-uri | 3.1.9 | 2 |
| library/ | 00032f157262 | fast-uri | 3.1.9 | 2 |
| n8nio/ | 14c4285bc303 | fast-uri | 3.1.9 | 2 |
| patrikx3/ | f19eb45b0694 | fast-uri | 3.1.9 | 2 |
| ghcr.io/ | b434cb9287ee | fast-uri | 3.1.9 | 2 |
| ghcr.io/ | 0cb0177dd278 | fast-uri | 3.1.9 | 2 |
| ghcr.io/ | 7dbff0fe5f53 | fast-uri | 4.2.3 | 2 |
| ghcr.io/ | 85909afc45bd | fast-uri | 3.1.9 | 2 |
| ghcr.io/ | 7e19bbdd2e7d | fast-uri | 3.1.9 | 2 |
| activepieces/ | 26daa5e1807f | fast-uri | 4.2.3 | 1 |
| akeyless/ | 0f582fc294a0 | fast-uri | 3.1.9 | 1 |
| betterdb/ | c4910692b3fc | fast-uri | 3.1.9 | 1 |
| bluerange/ | 90a4e5b92cc6 | fast-uri | 3.1.9 | 1 |
| budibase/ | 44fe6feab985 | fast-uri | 3.1.9 | 1 |
| chainsafe/ | f3d339e96267 | fast-uri | 4.2.3 | 1 |
| continuoussecuritytooling/ | 1be60d1bc942 | fast-uri | 3.1.9 | 1 |
| decisionrules/ | bb3a93224b5a | fast-uri | 3.1.9 | 1 |
| docmost/ | b56947fcfd08 | fast-uri | 3.1.9 | 1 |
| drumsergio/ | e66bb00c2696 | fast-uri | 3.1.9 | 1 |
| epam/ | 7bceacad3de2 | fast-uri | 3.1.9 | 1 |
| etherpad/ | 3d59d633d285 | fast-uri | 3.1.9 | 1 |
| etherpad/ | 98d395769b3b | fast-uri | 3.1.9 | 1 |
| evershop/ | 2acdcd7ed59f | fast-uri | 3.1.9 | 1 |
| flanksource/ | 2bb089c79fc0 | fast-uri | 3.1.9 | 1 |
| flanksource/ | 8d17f0c08b20 | fast-uri | 3.1.9 | 1 |
| gorules/ | 23b5efdea938 | fast-uri | 3.1.9 | 1 |
| growthbook/ | c8a124f55dca | fast-uri | 3.1.9 | 1 |
| growthbook/ | dca716a7bf47 | fast-uri | 3.1.9 | 1 |
| haohanyang/ | f4f8fe4e21f1 | fast-uri | 3.1.9 | 1 |
| helmforge/ | 5a6c2c449840 | fast-uri | 3.1.9 | 1 |
| hoppscotch/ | 3160f5b3acf4 | fast-uri | 3.1.9 | 1 |
| infisical/ | bb8352b71cea | fast-uri | 3.1.9 | 1 |
| kitware/ | 6fab5f5ec6f2 | fast-uri | 3.1.9 | 1 |
| library/ | 8e07c5ec63d9 | fast-uri | 3.1.9 | 1 |
| library/ | c0d83a8d4522 | fast-uri | 3.1.9 | 1 |
| library/ | db4c56c196d6 | fast-uri | 3.1.9 | 1 |
| library/ | 4116dd6a5838 | fast-uri | 3.1.9 | 1 |
| lissy93/ | 5e4feb4acbd5 | fast-uri | 3.1.9 | 1 |
| makeplane/ | fab034a2be8c | fast-uri | 3.1.9 | 1 |
| makeplane/ | 12c33418c1ec | fast-uri | 3.1.9 | 1 |
| makeplane/ | c4a6236c4080 | fast-uri | 3.1.9 | 1 |
| mcp/ | 5ffbf7f0a8aa | fast-uri | 3.1.9 | 1 |
| mitre/ | 06f6e72d416a | fast-uri | 3.1.9 | 1 |