CVE-2026-12590
LowAdvisory
Published 20 Jul 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.7
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 515
- of 17,781 indexed, latest versions
- Container images
- 522
- deployed by those charts
- Fix available
- 1 of 1
- affected package
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Carried by container images the latest versions of 515 of 17,781 indexed charts deploy, on 522 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| body-parsernpm | 1.13.3, 1.14.2, 1.16.1, 1.17.2+15 more | 1.20.6, 2.3.0 | 522 |
- OSV records
- GHSA-v422-hmwv-36x6
Charts affected
515 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| flagsmithone-acre-fundVerified publisher | 0.1.5 | 1 of 6See more | 6,868 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| n8none-acre-fundVerified publisher | 0.1.52 | 1 of 3See more | 7,776 |
| openclaw-with-brainopenclaw-with-brainVerified publisher | 0.1.67 | 1 of 3See more | 5,218 |
| kratos-selfservice-ui-nodeory | 0.64.0 | 1 of 1See more | 1,966 |
| pacmanpacmanVerified publisher | 2.0.2 | 1 of 2See more | 638 |
| overseerrpree-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,702 |
| browserless-chromesagikazarmarkVerified publisher | 0.0.5 | 1 of 1See more | 24,488 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,566 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 1 of 10See more | 28,534 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| predatorzooz | 1.7.0 | 1 of 1See more | 2,851 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 1,044 |
| dltbrokerassist-iot-distributed-broker | 0.2.0 | 1 of 9See more | 77,706 |
| dltloggingassist-iot-logging-auditing | 0.2.0 | 1 of 9See more | 77,687 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 1,991 |
| actualbeluga-cloudVerified publisher | 2.0.0 | 1 of 1See more | 1,262 |
| maildevchristianhuthVerified publisher | 1.6.0 | 1 of 1See more | 1,143 |
| skoonerchristianhuthVerified publisher | 0.4.0 | 1 of 1See more | 1,341 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 7 of 12See more | 38,346 |
| mastodondefault-ghVerified publisher | 0.3.1 | 1 of 3See more | 5,056 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 7,473 |
| jellystatdjjudas21Verified publisher | 0.1.12 | 1 of 1See more | 1,722 |
| joplin-serverdjjudas21Verified publisher | 5.5.8 | 1 of 1See more | 3,925 |
| rstudiodsri-helm-charts | 0.1.28 | 1 of 1See more | 5,670 |
| enbuildenbuildVerified publisher | 0.0.50 | 3 of 6See more | 31,510 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 1,442 |
| iobrokereugen | 0.2.6 | 1 of 1See more | 11,458 |
| recaptcha-v3-verifierf3k-techVerified publisher | 1.110.0 | 1 of 1See more | 1,208 |
| ranetogabisonfire | 0.1.2 | 1 of 1See more | 2,519 |
| ghostgeek-cookbookVerified publisher | 2.2.0 | 1 of 1See more | 4,260 |
| magic-mirrorgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 4,405 |
| overseerrgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 3,444 |
| recipesgeek-cookbookVerified publisher | 6.6.2 | 1 of 2See more | 7,801 |
| sendgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,148 |
| uptime-kumageek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 5,079 |
| youtubedl-materialgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 4,410 |
| ghostfolioghostfolioVerified publisher | 0.5.4 | 1 of 3See more | 3,123 |
| uptimekumahelm-l3st86Verified publisher | 0.1.10 | 1 of 1See more | 4,196 |
| pdc-portali4trustVerified publisher | 2.3.2 | 1 of 1See more | 2,723 |
| immichimmich-helm | 0.3.0 | 1 of 4See more | 15,712 |
| todo-appjunktext-direct | 1.1.4 | 1 of 1See more | 3,369 |
| kenerkenerVerified publisher | 0.2.0 | 1 of 1See more | 5,228 |
| dashykrzwiatrzyk | 1.0.0 | 1 of 1See more | 3,143 |
| lifecycle-jira-integrationlifecycle-jira-integration | 1.0.0 | 1 of 1See more | 927 |
| litlyxlitlyx | 0.2.0 | 2 of 5See more | 7,874 |
| actualbudgetm0nsterrr-actualbudgetVerified publisher | 2.10.0 | 1 of 1See more | 1,091 |
| chatwootmaxcrm-chartsVerified publisher | 1.1.201 | 1 of 4See more | 5,940 |
| Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher | 1.0.1 | 1 of 6See more | 19,187 |
| food-managermoreillonVerified publisher | 0.5.0 | 1 of 2See more | 13,738 |
Container images carrying it
522 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| folioci/ | f0655a6a08fd | body-parser | 1.20.6 | 1 |
| fonoster/ | e27001f2813c | body-parser | 1.20.6 | 1 |
| fosrl/ | c32ad797ab96 | body-parser | 2.3.0 | 1 |
| frappe/ | 2095767a9e82 | body-parser | 1.20.6 | 1 |
| ghostfolio/ | e3c6ab53e49b | body-parser | 2.3.0 | 1 |
| glenndehaan/ | 6ff6310683bf | body-parser | 1.20.6 | 1 |
| glenndehaan/ | 99b9e4f73848 | body-parser | 1.20.6 | 1 |
| glenndehaan/ | 0a7116f48bfe | body-parser | 1.20.6 | 1 |
| governify/ | 6d3d1a5b46a9 | body-parser | 1.20.6 | 1 |
| gristlabs/ | 6e71b1914a7e | body-parser | 1.20.6 | 1 |
| halkeye/ | 53eb2b3cd4cb | body-parser | 1.20.6 | 1 |
| halkeye/ | 9764d2202130 | body-parser | 1.20.6 | 1 |
| hamid2021/ | 429d99890c3c | body-parser | 1.20.6 | 1 |
| hansehe/ | 58e09540afbc | body-parser | 1.20.6 | 1 |
| hecrom/ | 5454b54d5b28 | body-parser | 1.20.6 | 1 |
| helga09/ | 7999bc8b77c0 | body-parser | 1.20.6 | 1 |
| henrywhitaker3/ | 47159a940229 | body-parser | 1.20.6 | 1 |
| heywood8/ | 0bc9ab313d37 | body-parser | 1.20.6 | 1 |
| hhaluk/ | a6555953d941 | body-parser | 1.20.6 | 1 |
| hirosystems/ | 9c98b23c1515 | body-parser | 1.20.6 | 1 |
| hkotel/ | 3c04c0e85039 | body-parser | 1.20.6 | 1 |
| hoppscotch/ | 538fe6ded4b6 | body-parser | 1.20.6 | 1 |
| hugohg34/ | 503e5d8960ff | body-parser | 1.20.6 | 1 |
| i4trust/ | 3e77858e1219 | body-parser | 1.20.6 | 1 |
| ianw/ | dc49dd460c37 | body-parser | 1.20.6 | 1 |
| ibarreche/ | c8970ac1c8dc | body-parser | 1.20.6 | 1 |
| ibmcom/ | e2a86997b36b | body-parser | 1.20.6 | 1 |
| ibmcom/ | 02d882f2836e | body-parser | 1.20.6 | 1 |
| ibmcom/ | ab3fd1fdfa18 | body-parser | 1.20.6 | 1 |
| ibmcom/ | ed5505e5c7ec | body-parser | 1.20.6 | 1 |
| ibmcom/ | e17bdccc5030 | body-parser | 1.20.6 | 1 |
| ilum/ | 716437a51a6c | body-parser | 1.20.6 | 1 |
| inseefrlab/ | 31f04ca7436b | body-parser | 1.20.6 | 1 |
| interlayhq/ | 423d567d47aa | body-parser | 1.20.6 | 1 |
| interlayhq/ | 5b2c414307b9 | body-parser | 1.20.6 | 1 |
| jakowenko/ | b858bac9e32a | body-parser | 1.20.6 | 1 |
| jayfong/ | 163e5d621910 | body-parser | 1.20.6 | 1 |
| jhidalgo3/ | dfa8628d79f5 | body-parser | 1.20.6 | 1 |
| joplin/ | 52af57880c0e | body-parser | 1.20.6 | 1 |
| joplin/ | b87564ef34e9 | body-parser | 1.20.6 | 1 |
| josepht05/ | 36cb0c618c94 | body-parser | 1.20.6 | 1 |
| josepht05/ | d94024965d78 | body-parser | 1.20.6 | 1 |
| junktext/ | a70936c04aed | body-parser | 1.20.6 | 1 |
| junktext/ | d44adf5a4da2 | body-parser | 1.20.6 | 1 |
| kaushaln1/ | e9f2d5dfdba0 | body-parser | 1.20.6 | 1 |
| keyoxide/ | 96f27a71269d | body-parser | 1.20.6 | 1 |
| kobotoolbox/ | bcacc01bccd4 | body-parser | 1.20.6 | 1 |
| konradkleine/ | 181aad54ee64 | body-parser | 1.20.6 | 1 |
| koumoul/ | 7108d47be3b2 | body-parser | 1.20.6 | 1 |
| koumoul/ | 8eeca2e8285b | body-parser | 1.20.6 | 1 |