CVE-2026-111756
HighAdvisory
Published 20 Oct 2026In the index since 21 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 55
- of 18,208 indexed, latest versions
- Container images
- 46
- deployed by those charts
- Fix available
- 1 of 1
- affected package
follow-redirects array-form headers bypass cross-origin credential stripping
Carried by container images the latest versions of 55 of 18,208 indexed charts deploy, on 46 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| follow-redirectsnpm | 1.16.0 | 1.16.1 | 46 |
- OSV records
- GHSA-q3jh-wrc6-jgq8
Charts affected
55 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| n8nopen-8gears | 2.1.1 | 1 of 1See more | 2,408 |
| uptime-kumauptime-kumaVerified publisher | 4.2.0 | 1 of 1See more | 37,527 |
| budibasebudibase | 0.0.0-master | 2 of 7See more | 12,060 |
| docmosthelmforgeVerified publisher | 1.4.4 | 1 of 4See more | 4,777 |
| redisinsightredisinsight-guiVerified publisher | 1.3.5 | 1 of 1See more | 1,368 |
| heimdallheimdallOfficialVerified publisher | 3.3.3 | 1 of 2See more | 2,869 |
| karakeephelmforgeVerified publisher | 1.2.11 | 1See more | — |
| dbgateappscodeVerified publisher | 2026.3.30 | 1 of 1See more | 920 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 1 of 12See more | 43,195 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 9,996 |
| jellystatdjjudas21Verified publisher | 1.0.1 | 1 of 1See more | 2,162 |
| joplin-serverdjjudas21Verified publisher | 6.0.0 | 1 of 1See more | 3,000 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 2,214 |
| ghostfolioghostfolioVerified publisher | 0.5.4 | 1 of 3See more | 3,723 |
| growthbookgrowthbook | 5.1.0 | 1 of 2See more | 1,520 |
| n8nn8n-helm | 2.25.7 | 1 of 1See more | 4,152 |
| opentelemetry-demoopentelemetry-helmOfficialVerified publisher | 0.42.5 | 1See more | — |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 37,822 |
| tenuretenureVerified publisher | 1.0.6 | 1 of 2See more | 3,635 |
| linkwardenadnoctemVerified publisher | 0.5.1 | 1 of 2See more | 5,202 |
| homepagealareira | 1.0.1 | 1 of 1See more | 641 |
| codehubcodehubVerified publisher | 6.2.18 | 1 of 5See more | 15,472 |
| dapr-agentsdapr-agents-devVerified publisher | 0.1.5 | 1 of 31See more | 32,977 |
| dbgatedbgate-helm-chartVerified publisher | 0.1.8 | 1 of 1See more | 1,935 |
| node-redegebackVerified publisher | 2.0.13 | 1 of 1See more | 1,541 |
| azuriteemberstackVerified publisher | 1.0.22 | 1 of 1See more | 694 |
| hedgedocernail-hedgedoc | 5.0.0 | 1 of 1See more | 2,200 |
| consent-managerfiware | 0.2.0 | 1 of 1See more | 2,487 |
| jupyterhubhelmforgeVerified publisher | 1.0.7 | 1 of 3See more | 6,250 |
| ghostjanip81-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 4,788 |
| ghostk8s-home-lab-repo | 4.1.0 | 1 of 1See more | 4,298 |
| jupyterhub-chartk8s-jupyterhub | 0.1.0 | 1 of 1See more | 1,928 |
| cdashkitwareVerified publisher | 0.20.0 | 1 of 3See more | 13,737 |
| ghostkubernetes-homelab-helm-chartsVerified publisher | 0.2.3 | 1 of 2See more | 4,206 |
| homepagekubernetes-homelab-helm-chartsVerified publisher | 0.1.0 | 1 of 1See more | 1,551 |
| seerrkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 2,983 |
| uptime-kumalbenicio-communityVerified publisher | 0.1.1 | 1 of 1See more | 40,867 |
| node-redlmatfyVerified publisher | 0.1.6 | 1 of 1See more | 2,196 |
| uptime-kumaloeken-at-homeVerified publisher | 2.3.2 | 1 of 1See more | 40,867 |
| nubladolsst-sqre | 0.9.23 | 1 of 5See more | 6,548 |
| n8nn8n-openshiftVerified publisher | 1.18.0 | 1 of 1See more | 2,408 |
| uptime-kumancsaVerified publisher | 1.7.3 | 1 of 1See more | 37,377 |
| n8nopenshift | 1.18.0 | 1 of 1See more | 2,408 |
| redisinsightredisinsightVerified publisher | 0.1.0 | 1 of 1See more | 1,368 |
| uptime-kumarubxkubeVerified publisher | 1.2.1 | 1 of 1See more | 37,590 |
| joplin-serverschoenwald | 1.0.3 | 1 of 1See more | 3,000 |
| uptime-kumaschoenwald | 1.0.10 | 1 of 1See more | 37,388 |
| hedgedocsi-gitops | 0.12.3 | 1 of 2See more | 3,950 |
| fdi-dotstatsuite-sfs-solrstatcan | 1.0.2 | 1 of 4See more | 7,041 |
| fdi-dotstatsuite-sfs-solr-statefulstatcan | 1.0.2 | 1 of 2See more | 1,335 |
Container images carrying it
46 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| redis/ | b5e19ee240ab | follow-redirects | 1.16.1 | 4 |
| joplin/ | 3f7b852959aa | follow-redirects | 1.16.1 | 3 |
| jupyterhub/ | 69a7170eeeda | follow-redirects | 1.16.1 | 2 |
| louislam/ | 9aeb4e51d038 | follow-redirects | 1.16.1 | 2 |
| n8nio/ | 14c4285bc303 | follow-redirects | 1.16.1 | 2 |
| siscc/ | 12c5048f7402 | follow-redirects | 1.16.1 | 2 |
| ghcr.io/ | 643bd0be730d | follow-redirects | 1.16.1 | 2 |
| budibase/ | 44fe6feab985 | follow-redirects | 1.16.1 | 1 |
| budibase/ | de5e2e560ce8 | follow-redirects | 1.16.1 | 1 |
| cyfershepard/ | e61c759ec706 | follow-redirects | 1.16.1 | 1 |
| dbgate/ | 287077002446 | follow-redirects | 1.16.1 | 1 |
| dbgate/ | f2dc7423ea88 | follow-redirects | 1.16.1 | 1 |
| directus/ | 9c8470ea465c | follow-redirects | 1.16.1 | 1 |
| docmost/ | b56947fcfd08 | follow-redirects | 1.16.1 | 1 |
| ethpandaops/ | fb84b718500f | follow-redirects | 1.16.1 | 1 |
| ghostfolio/ | e3c6ab53e49b | follow-redirects | 1.16.1 | 1 |
| growthbook/ | c8a124f55dca | follow-redirects | 1.16.1 | 1 |
| jupyterhub/ | 3974ba945e65 | follow-redirects | 1.16.1 | 1 |
| kitware/ | da5abe941506 | follow-redirects | 1.16.1 | 1 |
| library/ | 1ef2e532ca4d | follow-redirects | 1.16.1 | 1 |
| library/ | 29773d6be407 | follow-redirects | 1.16.1 | 1 |
| library/ | 77196da4b0df | follow-redirects | 1.16.1 | 1 |
| louislam/ | 917318f9d7be | follow-redirects | 1.16.1 | 1 |
| louislam/ | 91e963bfda56 | follow-redirects | 1.16.1 | 1 |
| louislam/ | a8610b3b4c38 | follow-redirects | 1.16.1 | 1 |
| louislam/ | c74379ac4509 | follow-redirects | 1.16.1 | 1 |
| mitre/ | 06f6e72d416a | follow-redirects | 1.16.1 | 1 |
| n8nio/ | 761374d4eb84 | follow-redirects | 1.16.1 | 1 |
| n8nio/ | cfe2704ff858 | follow-redirects | 1.16.1 | 1 |
| nodered/ | 10f40d0a83e7 | follow-redirects | 1.16.1 | 1 |
| nodered/ | d73ae167cb9b | follow-redirects | 1.16.1 | 1 |
| tenureai/ | 5f5b222df9a5 | follow-redirects | 1.16.1 | 1 |
| treskon/ | e7970783bc8d | follow-redirects | 1.16.1 | 1 |
| truebyteinnovationllp/ | 6bf978b96279 | follow-redirects | 1.16.1 | 1 |
| twentycrm/ | e7d9948bf284 | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | 2ed0183564d7 | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | 8b621866ceb2 | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | 753eeb0cc22a | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | d8d784e50901 | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | 0664c28a039b | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | 604b1f493c92 | follow-redirects | 1.16.1 | 1 |
| ghcr.io/ | c4cbd5121236 | follow-redirects | 1.16.1 | 1 |
| mcr.microsoft.com/ | 830430c1da1a | follow-redirects | 1.16.1 | 1 |
| quay.io/ | 89bd85d7817f | follow-redirects | 1.16.1 | 1 |
| quay.io/ | abdb6b08815d | follow-redirects | 1.16.1 | 1 |
| quay.io/ | 56399619568b | follow-redirects | 1.16.1 | 1 |