CVE-2026-12151
HighAdvisory
Published 17 Jun 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.008
- 54th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 163
- of 17,781 indexed, latest versions
- Container images
- 150
- deployed by those charts
- Fix available
- 3 of 4
- affected packages
undici WebSocket client vulnerable to denial of service via fragment count bypass
Carried by container images the latest versions of 163 of 17,781 indexed charts deploy, on 150 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| undicinpm | 4.15.0, 5.6.0, 5.11.0, 5.12.0+38 more | 6.27.0, 7.28.0, 8.5.0 | 150 |
| node-undicideb | 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4, 5.26.3+dfsg1+~cs23.10.12-2+1 more | no fix listed | 9 |
| node-gypapk | 13.0.0-r0 | 13.0.0-r1 | 1 |
| npmapk | 11.17.0-r0 | 11.17.0-r1 | 1 |
- OSV records
- CGA-32wv-xpjw-59rwCGA-9j5m-pg63-wp3cDEBIAN-CVE-2026-12151GHSA-vxpw-j846-p89qUBUNTU-CVE-2026-12151
- Also known as
- CGA-j7wm-499f-j6fj, CGA-r8m3-vggv-7226
Charts affected
163 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| penpotpenpotOfficialVerified publisher | 1.9.0 | 2 of 4See more | 4,314 |
| lemmyananace-chartsVerified publisher | 0.6.15 | 1 of 5See more | 7,210 |
| apisix-ingress-controllerapisix | 1.3.1 | 1 of 2See more | 1,616 |
| chatwootchatwootVerified publisher | 2.0.24 | 1 of 3See more | 9,203 |
| stacks-blockchain-apihirosystemsVerified publisher | 6.5.1 | 1 of 5See more | 8,364 |
| openclawopenclaw-helmVerified publisher | 1.5.40 | 1 of 2See more | 5,660 |
| servarrkubitodevVerified publisher | 1.5.2 | 1 of 10See more | 3,004 |
| budibasebudibase | 0.0.0-master | 1 of 7See more | 10,775 |
| n8nn8n | 0.23.0 | 1 of 1See more | 5,639 |
| openclawopenclawVerified publisher | 1.91.3 | 1 of 2See more | 2,977 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 2,938 |
| syftopenmined | 0.9.5 | 1 of 6See more | 17,245 |
| backstagerhdh-chartVerified publisher | 4.0.1 | 1 of 2See more | 1,339 |
| dialdialOfficialVerified publisher | 7.2.0 | 1 of 4See more | 2,163 |
| foundry-vttfoundry-vttVerified publisher | 12.343.0 | 1 of 1See more | 723 |
| karakeephelmforgeVerified publisher | 1.2.9 | 1 of 3See more | 9,460 |
| openhabhelmforgeVerified publisher | 1.2.0 | 1 of 1See more | 3,641 |
| headplanenbcloudVerified publisher | 0.1.2 | 1 of 4See more | 7,949 |
| wg-easywg-easyVerified publisher | 0.1.6 | 1 of 1See more | 725 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 1 of 10See more | 28,839 |
| duplistatusduplistatusVerified publisher | 1.2.0 | 1 of 2See more | 1,870 |
| graphql-hivegraphql-hive | 1.0.0 | 1 of 17See more | 10,311 |
| dynamodbkeyporttech | 0.1.27 | 1 of 2See more | 1,304 |
| kubebadgeskubebadges | 0.1.3 | 1 of 2See more | 1,798 |
| openclaw-with-brainopenclaw-with-brainVerified publisher | 0.1.67 | 1 of 3See more | 5,218 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 977 |
| wgerwgerOfficialVerified publisher | 1.0.0 | 1 of 8See more | 8,491 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 1,044 |
| hermes-agentankra-chartsVerified publisher | 0.3.1 | 1 of 1See more | 5,880 |
| kinesisaws-kinesis-local | 0.8.0 | 1 of 1See more | 360 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 1,991 |
| home-assistant-matter-servercharts-derwitt-devVerified publisher | 4.2.1 | 1 of 2See more | 2,360 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 7,473 |
| jellystatdjjudas21Verified publisher | 0.1.12 | 1 of 1See more | 1,722 |
| ghostfolioghostfolioVerified publisher | 0.5.4 | 1 of 3See more | 3,123 |
| globalpingglobalpingVerified publisher | 1.0.11 | 1 of 1See more | 518 |
| kenerkenerVerified publisher | 0.2.0 | 1 of 1See more | 5,228 |
| keycloak-reporterkeycloak-reporterVerified publisher | 1.4.15 | 1 of 1See more | 1,322 |
| difykubeblocksVerified publisher | 0.5.1 | 1 of 5See more | 20,403 |
| n8nn8n-helm | 2.25.7 | 1 of 1See more | 2,575 |
| openvaultopenvaultVerified publisher | 0.8.1 | 1 of 2See more | 6,873 |
| uptime-kumapascaliskeVerified publisher | 3.0.0 | 1 of 1See more | 6,883 |
| peertubepeertubeVerified publisher | 0.1.3 | 1 of 1See more | 7,035 |
| rocketadminrocketadminOfficialVerified publisher | 1.0.42 | 1 of 1See more | 5,482 |
| jellyseerrrtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 1See more | 2,823 |
| uptime-kumasb-helm-charts | 0.4.0 | 1 of 1See more | 38,107 |
| immichsecustorVerified publisher | 2.0.4 | 1 of 1See more | 3,059 |
| karakeepself-hosters-by-nightVerified publisher | 2.5.1 | 1 of 1See more | 5,213 |
| wg-easyslybase-wg-easyVerified publisher | 1.2.0 | 1 of 1See more | 725 |
Container images carrying it
150 by charts deploying them
A fixed version is listed for 3 of the 4 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| jupyterhub/ | 3974ba945e65 | node-undici undici | no fix listed 6.27.0 | 1 |
| kitware/ | d7767d9b9da4 | undici | 6.27.0 | 1 |
| kubebb/ | fd8ecbd73213 | undici | 6.27.0 | 1 |
| langgenius/ | 066035f93856 | node-undici undici | no fix listed 6.27.0 | 1 |
| langgenius/ | fca918260dd6 | node-undici undici | no fix listed 6.27.0 | 1 |
| langgenius/ | 8dd9de6b6190 | undici | 6.27.0 | 1 |
| langgenius/ | ba1dd1d0bcea | undici | 6.27.0 | 1 |
| library/ | 1ef2e532ca4d | undici | 7.28.0 | 1 |
| library/ | 2654b1e90413 | undici | 6.27.0 | 1 |
| library/ | 29773d6be407 | undici | 6.27.0 | 1 |
| library/ | 77196da4b0df | undici | 6.27.0 | 1 |
| library/ | 83f7bf209844 | undici | 6.27.0 | 1 |
| library/ | ac533a6988ee | undici | 6.27.0 | 1 |
| library/ | 04c0fc150f3a | undici | 6.27.0 | 1 |
| louislam/ | 059b49d64739 | undici | 6.27.0 | 1 |
| louislam/ | 4c364ef96aad | undici | 6.27.0 | 1 |
| louislam/ | 91e963bfda56 | undici | 6.27.0 | 1 |
| louislam/ | 9865163f92c1 | undici | 6.27.0 | 1 |
| mautic/ | eb8cc73d97e1 | undici | 6.27.0 | 1 |
| n8nio/ | 761374d4eb84 | undici | 7.28.0 | 1 |
| n8nio/ | 8b39ed5a2de9 | undici | 6.27.0 | 1 |
| n8nio/ | dd171d45102a | undici | 6.27.0 | 1 |
| nocodb/ | d9516f0bf546 | undici | 7.28.0 | 1 |
| nodered/ | 10f40d0a83e7 | undici | 6.27.0 | 1 |
| nousresearch/ | e0df6adebddf | undici | 6.27.0 | 1 |
| offchainlabs/ | 9f779fa84b7b | node-undici undici | no fix listed 6.27.0 | 1 |
| offchainlabs/ | e95865866129 | node-undici undici | no fix listed 6.27.0 | 1 |
| opea/ | 2bee4eb66f3e | undici | 6.27.0 | 1 |
| openhab/ | bfd4a60e90da | node-undici undici | no fix listed 7.28.0 | 1 |
| openmined/ | d11524a3854a | undici | 6.27.0 | 1 |
| outlinewiki/ | 832051f039b4 | undici | 6.27.0 | 1 |
| penpotapp/ | 72a8061e8806 | undici | 6.27.0 | 1 |
| penpotapp/ | 84f3f07ead11 | undici | 6.27.0 | 1 |
| polonel/ | 0cf6513f6fe3 | undici | 6.27.0 | 1 |
| rocketadmin/ | 10955ef540b9 | undici | 6.27.0 | 1 |
| saidsef/ | 67025e3a163e | undici | 6.27.0 | 1 |
| sbs20/ | dad1fd6e9a98 | node-undici undici | no fix listed 6.27.0 | 1 |
| shieldsio/ | fa194b446e42 | undici | 6.27.0 | 1 |
| speckle/ | 49d10dcdfb91 | undici | 6.27.0 | 1 |
| speckle/ | 4b6a0750d5aa | undici | 6.27.0 | 1 |
| speckle/ | 52f8eabf5cea | undici | 6.27.0 | 1 |
| speckle/ | 687f43ab16f3 | undici | 6.27.0 | 1 |
| speckle/ | 75cdf256067b | undici | 6.27.0 | 1 |
| speckle/ | 79f14a2bf931 | undici | 6.27.0 | 1 |
| speckle/ | 89a5872375f9 | undici | 6.27.0 | 1 |
| speckle/ | 8fd157733393 | undici | 6.27.0 | 1 |
| speckle/ | bf6a501b2210 | undici | 6.27.0 | 1 |
| speckle/ | e8413f57b327 | undici | 6.27.0 | 1 |
| supabase/ | c8eb9858eafe | undici | 7.28.0 | 1 |
| tensorzero/ | f2563d54724e | undici | 6.27.0 | 1 |