CVE-2026-12590
LowAdvisory
Published 20 Jul 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.7
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 515
- of 17,781 indexed, latest versions
- Container images
- 522
- deployed by those charts
- Fix available
- 1 of 1
- affected package
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Carried by container images the latest versions of 515 of 17,781 indexed charts deploy, on 522 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| body-parsernpm | 1.13.3, 1.14.2, 1.16.1, 1.17.2+15 more | 1.20.6, 2.3.0 | 522 |
- OSV records
- GHSA-v422-hmwv-36x6
Charts affected
515 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| hedgedocvista | 0.1.1 | 1 of 1See more | 3,118 |
| vote-appvote-appVerified publisher | 1.0.7 | 1 of 6See more | 3,031 |
| resultappvoting-app-helm-charts-repoVerified publisher | 1.0.0 | 1 of 1See more | 1,263 |
| voteappvoting-app-helm-charts-repoVerified publisher | 1.0.0 | 1 of 5See more | 8,262 |
| resultappvoting-app-helm-charts-repo-cloudVerified publisher | 1.0.0 | 1 of 1See more | 1,263 |
| voteappvoting-app-helm-charts-repo-cloudVerified publisher | 1.0.0 | 1 of 5See more | 8,262 |
| sirenwateim | 1.0.2 | 1 of 1See more | 5,984 |
| wazuhwazuh-helm-eksVerified publisher | 1.2.10 | 1 of 6See more | 5,484 |
| webhookiewebhookie | 0.1.2 | 1 of 1See more | 14,364 |
| webhookie-allwebhookie | 0.1.2 | 1 of 3See more | 28,605 |
| wikiwikijs | 3.0.0 | 1 of 2See more | 5,459 |
| playwright-synthetic-monitoringwork-adventure | 1.0.1 | 1 of 1See more | 14,100 |
| workadventureworkadventure | 1.1.0 | 2 of 9See more | 16,083 |
| skoonerxdVerified publisher | 1.1.0 | 1 of 1See more | 1,752 |
| alertmanager-matrix-forwarderzloi-space | 1.0.1 | 1 of 2See more | 3,118 |
Container images carrying it
522 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| codercom/ | 47605610ad8d | body-parser | 1.20.6 | 1 |
| codetogether/ | 4348c8a38752 | body-parser | 1.20.6 | 1 |
| coldatom/ | eae9e82da080 | body-parser | 1.20.6 | 1 |
| coldatom/ | 7c2fbbb41bcf | body-parser | 1.20.6 | 1 |
| conduction/ | d591f5e6f2a9 | body-parser | 1.20.6 | 1 |
| countly/ | f4cc7447c4f5 | body-parser | 1.20.6 | 1 |
| countly/ | e3c238248f99 | body-parser | 1.20.6 | 1 |
| countly/ | 2acbc11499b6 | body-parser | 1.20.6 | 1 |
| cryptexlabs/ | 189c07411d7c | body-parser | 1.20.6 | 1 |
| cyfershepard/ | c4e2dfa8bddf | body-parser | 1.20.6 | 1 |
| dacinfomotion/ | 68fa393b472c | body-parser | 1.20.6 | 1 |
| danny1dockerhub/ | e434683fcc89 | body-parser | 1.20.6 | 1 |
| datarhei/ | 655e12f9eeed | body-parser | 1.20.6 | 1 |
| davdiv/ | a85f99be882c | body-parser | 1.20.6 | 1 |
| davidvmar/ | 5663f5b24615 | body-parser | 1.20.6 | 1 |
| decayofmind/ | 1e18e92fe694 | body-parser | 1.20.6 | 1 |
| defactops/ | 07b663c0092a | body-parser | 1.20.6 | 1 |
| denisshav/ | 4cc8dc5a4499 | body-parser | 1.20.6 | 1 |
| dessalines/ | ee4c620d8e93 | body-parser | 1.20.6 | 1 |
| devkrishan001/ | f1c3acadeabe | body-parser | 2.3.0 | 1 |
| devravinder/ | 5325a96967b5 | body-parser | 1.20.6 | 1 |
| devspacecloud/ | deef55ff29a7 | body-parser | 1.20.6 | 1 |
| dipugodocker/ | d431c37fe1cd | body-parser | 1.20.6 | 1 |
| directus/ | 9c8470ea465c | body-parser | 1.20.6 | 1 |
| directus/ | e3c8bb975350 | body-parser | 1.20.6 | 1 |
| docmost/ | 41c8d777cf23 | body-parser | 2.3.0 | 1 |
| eameti/ | f36642affa86 | body-parser | 1.20.6 | 1 |
| eclipseaerios/ | a4b4c2e7fe62 | body-parser | 1.20.6 | 1 |
| eclipseaerios/ | 8b123bec5679 | body-parser | 1.20.6 | 1 |
| enketo/ | dcad9c2273f6 | body-parser | 1.20.6 | 1 |
| ethereumex/ | a7603aa8df4c | body-parser | 1.20.6 | 1 |
| ethereumoptimism/ | e07968a0e686 | body-parser | 1.20.6 | 1 |
| etherpad/ | b723fe5f2594 | body-parser | 2.3.0 | 1 |
| ethersphere/ | 7624f11a72ad | body-parser | 1.20.6 | 1 |
| ethersphere/ | 61f5419afbcd | body-parser | 1.20.6 | 1 |
| ethersphere/ | 513154aab230 | body-parser | 1.20.6 | 1 |
| ethpandaops/ | fb84b718500f | body-parser | 1.20.6 | 1 |
| evoapicloud/ | 966625532d90 | body-parser | 1.20.6 | 1 |
| f3ktech/ | 48e78987cf91 | body-parser | 1.20.6 | 1 |
| fallenbagel/ | 4538137bc5af | body-parser | 1.20.6 | 1 |
| fallenbagel/ | 6dcdb5ba5091 | body-parser | 1.20.6 | 1 |
| felipecs8/ | 4e51693fcdf5 | body-parser | 1.20.6 | 1 |
| felipecs8/ | f945423be36d | body-parser | 1.20.6 | 1 |
| felipecs8/ | db6d44e325a1 | body-parser | 1.20.6 | 1 |
| fiware/ | d551a13e8278 | body-parser | 1.20.6 | 1 |
| fiware/ | a1b6ed4ae84f | body-parser | 1.20.6 | 1 |
| fiware/ | 879b21a0d36d | body-parser | 1.20.6 | 1 |
| fiware/ | fe11f55a926d | body-parser | 1.20.6 | 1 |
| flagsmith/ | df02a29e8b0c | body-parser | 1.20.6 | 1 |
| foggbh/ | 8b7a2e5ecf4e | body-parser | 1.20.6 | 1 |