StackRadar

CVE-2026-16728

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
7th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
222
of 17,781 indexed, latest versions
Container images
203
deployed by those charts
Fix available
1 of 2
affected packages

undici vulnerable to downstream response desynchronization via retry interceptor

Carried by container images the latest versions of 222 of 17,781 indexed charts deploy, on 203 images.

Affected packageAffected versionsFixed inImages
node-undicideb5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4, 5.26.3+dfsg1+~cs23.10.12-2+1 moreno fix listed9
undicinpm4.15.0, 5.6.0, 5.11.0, 5.12.0+41 more6.28.0, 7.29.0, 8.9.0203
OSV records
DEBIAN-CVE-2026-16728GHSA-8xcm-r25x-g524UBUNTU-CVE-2026-16728

Charts affected

222 by stars
ChartLatestAffected imagesRadar Score
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
undici@6.27.0
6.28.0

Open the chart page →

1,038
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
undici@6.27.0
6.28.0

Open the chart page →

30,159
backstagebackstageOfficialVerified publisher2.10.11 of 1See more

backstage backstage 2.10.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/backstage/backstage:latest792e262ea504
undici@6.27.0
6.28.0

Open the chart page →

1,195
penpotpenpotOfficialVerified publisher1.9.02 of 4See more

penpot penpot 1.9.0

2 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
penpotapp/exporter:2.17.272a8061e8806
undici@6.26.0
6.28.0
penpotapp/mcp:2.17.284f3f07ead11
undici@6.27.0
6.28.0

Open the chart page →

4,314
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
undici@6.27.0
6.28.0

Open the chart page →

22,002
actualbudgetcommunity-chartsVerified publisher1.9.41 of 1See more

actualbudget community-charts 1.9.4

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
undici@6.27.0
6.28.0

Open the chart page →

1,091
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
undici@6.26.0
6.28.0

Open the chart page →

7,210
apisix-ingress-controllerapisix1.3.11 of 2See more

apisix-ingress-controller apisix 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
undici@6.25.0
6.28.0

Open the chart page →

1,616
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
undici@6.25.0
6.28.0

Open the chart page →

9,203
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
undici@6.21.2
6.28.0

Open the chart page →

8,364
localstacklocalstack0.7.01 of 1See more

localstack localstack 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
localstack/localstack-pro:latest4aef81c53168
undici@6.27.0
6.28.0

Open the chart page →

2,156
oneuptimeoneuptimeOfficialVerified publisher13.0.43 of 7See more

oneuptime oneuptime 13.0.4

3 of the 7 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
oneuptime/nginx:release6da7de4fc0f3
undici@6.27.0
6.28.0
oneuptime/probe:release6b2d98713711
undici@6.27.0
6.28.0
oneuptime/runner:release4accc516d800
undici@6.27.0
6.28.0

Open the chart page →

11,192
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
undici@8.3.0
8.9.0

Open the chart page →

5,660
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
undici@6.25.0
6.28.0

Open the chart page →

3,004
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
undici@6.21.3
6.28.0

Open the chart page →

10,775
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
undici@6.9.0
6.28.0

Open the chart page →

5,639
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
undici@6.26.0
6.28.0

Open the chart page →

2,977
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.28.0

Open the chart page →

2,938
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
openmined/syft-frontend:0.9.5d11524a3854a
undici@6.11.1
6.28.0

Open the chart page →

17,245
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
undici@7.28.0
7.29.0

Open the chart page →

5,564
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
undici@7.28.0
7.29.0

Open the chart page →

1,339
dialdialOfficialVerified publisher7.2.01 of 4See more

dial dial 7.2.0

1 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
epam/ai-dial-chat:0.49.0bd6b13695cdc
undici@6.26.0
6.28.0

Open the chart page →

2,163
foundry-vttfoundry-vttVerified publisher12.343.01 of 1See more

foundry-vtt foundry-vtt 12.343.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
felddy/foundryvtt:12.343.06c5e3e9ffbb0
undici@6.19.7
6.28.0

Open the chart page →

723
karakeephelmforgeVerified publisher1.2.92 of 3See more

karakeep helmforge 1.2.9

2 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
undici@6.27.0
6.28.0
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
undici@6.26.0
6.28.0

Open the chart page →

9,460
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
node-undici@7.3.0+dfsg1+~cs24.12.11-1
undici@7.3.0
no fix listed
7.29.0

Open the chart page →

3,641
libredb-studiolibredb-studioVerified publisher0.1.631 of 1See more

libredb-studio libredb-studio 0.1.63

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/libredb/libredb-studio:0.15.04b696f960ac1
undici@6.27.0
6.28.0

Open the chart page →

1,222
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
undici@6.21.0
6.28.0

Open the chart page →

7,949
wg-easywg-easyVerified publisher0.1.61 of 1See more

wg-easy wg-easy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:150e7bc9d34e86
undici@6.26.0
6.28.0

Open the chart page →

725
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
undici@6.27.0
6.28.0

Open the chart page →

7,146
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
undici@5.28.4
6.28.0

Open the chart page →

28,839
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
undici@6.26.0
6.28.0

Open the chart page →

1,870
rsshubgabe565Verified publisher0.8.01 of 3See more

rsshub gabe565 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
diygod/rsshub:latest1d4b508b6357
undici@6.27.0
6.28.0

Open the chart page →

1,717
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
undici@6.27.0
6.28.0

Open the chart page →

1,447
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0

Open the chart page →

10,311
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
undici@6.25.0
6.28.0

Open the chart page →

1,304
kubebadgeskubebadges0.1.31 of 2See more

kubebadges kubebadges 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
shieldsio/shields:nextfa194b446e42
undici@6.26.0
6.28.0

Open the chart page →

1,798
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
undici@6.25.0
6.28.0

Open the chart page →

5,218
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.28.0

Open the chart page →

977
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latestbf46f66e5dcc
undici@6.26.0
6.28.0

Open the chart page →

8,491
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
undici@7.24.4
7.29.0

Open the chart page →

4,016
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
undici@6.26.0
6.28.0

Open the chart page →

1,044
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
undici@6.26.0
6.28.0

Open the chart page →

5,880
kinesisaws-kinesis-local0.8.01 of 1See more

kinesis aws-kinesis-local 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
saidsef/aws-kinesis-local:v2026.0667025e3a163e
undici@6.26.0
6.28.0

Open the chart page →

360
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
undici@6.25.0
6.28.0

Open the chart page →

1,991
home-assistant-matter-servercharts-derwitt-devVerified publisher4.2.11 of 2See more

home-assistant-matter-server charts-derwitt-dev 4.2.1

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/matter-js/matterjs-server:1.4.054232d0d3e7d
undici@6.26.0
6.28.0

Open the chart page →

2,360
node-redcharts-derwitt-devVerified publisher2.1.21 of 1See more

node-red charts-derwitt-dev 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
nodered/node-red:5.0.7a649dd711d55
undici@6.27.0
6.28.0

Open the chart page →

101
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
undici@6.27.0
6.28.0

Open the chart page →

2,173
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
undici@6.27.0
6.28.0

Open the chart page →

9,205
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
undici@7.24.5
7.29.0

Open the chart page →

7,473
jellystatdjjudas21Verified publisher0.1.121 of 1See more

jellystat djjudas21 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
undici@6.26.0
6.28.0

Open the chart page →

1,722

Container images carrying it

203 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
library/node:ltsbe23f54a88d3
undici@6.27.0
6.28.0
3
localstack/localstack-pro:latest4aef81c53168
undici@6.27.0
6.28.0
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
undici@6.25.0
6.28.0
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.28.0
3
actualbudget/actual-server:26.9.0552beab3dec8
undici@6.27.0
6.28.0
2
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.28.0
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
undici@5.28.4
6.28.0
2
homebridge/homebridge:latest77c685a40911
undici@6.27.0
6.28.0
2
library/ghost:6.63.0e05bc1169fb2
undici@6.27.0
6.28.0
2
library/node:24.21.0-alpine3.23159fe6464903
undici@6.27.0
6.28.0
2
library/node:24.21.0-alpinebe80f76cf40e
undici@6.27.0
6.28.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
undici@6.25.0
6.28.0
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
undici@6.27.0
6.28.0
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
undici@7.11.0
7.29.0
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
undici@7.10.0
7.29.0
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
undici@7.16.0
7.29.0
2
n8nio/n8n:2.36.714c4285bc303
undici@6.27.0
6.28.0
2
patrikx3/p3x-redis-ui:latestf19eb45b0694
undici@6.27.0
6.28.0
2
rajnandan1/kener:3.2.1930407afca731
undici@6.21.1
6.28.0
2
requarks/wiki:2:latest68f0d1848261
undici@6.25.0
6.28.0
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
undici@6.26.0
6.28.0
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
undici@5.22.0
6.28.0
2
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
undici@6.27.0
6.28.0
2
ghcr.io/api7/adc:0.27.1f65f53dd9668
undici@6.25.0
6.28.0
2
ghcr.io/libredb/libredb-studio:0.15.04b696f960ac1
undici@6.27.0
6.28.0
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
undici@6.26.0
6.28.0
2
aaronshaf/dynamodb-admin:latestac41724cd997
undici@6.25.0
6.28.0
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
undici@7.24.1
7.29.0
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
undici@5.28.3
6.28.0
1
archivebox/archivebox:0.7.41a5a37331091
undici@6.25.0
6.28.0
1
budibase/apps:3.41.344fe6feab985
undici@6.21.3
6.28.0
1
catalysm/csmm:latestf003b35f54d9
undici@5.29.0
6.28.0
1
chainsafe/lodestar:latest5593f6e97912
undici@6.27.0
6.28.0
1
chatwoot/chatwoot:v4.15.167ebc751c171
undici@6.25.0
6.28.0
1
chocobozzz/peertube:v8.1.5052712130691
undici@6.24.1
6.28.0
1
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
undici@6.26.0
6.28.0
1
cryptexlabs/authf:0.12.11189c07411d7c
undici@6.19.8
6.28.0
1
cspconsole/report-processor:1.0.279a2d8840bfdf
undici@5.29.0
6.28.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
undici@6.26.0
6.28.0
1
deconzcommunity/deconz:2.29.2062de2362641
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
undici@6.26.0
6.28.0
1
directus/directus:12.0.29c8470ea465c
undici@7.24.5
7.29.0
1
directus/directus:11.1.0e3c8bb975350
undici@6.19.5
6.28.0
1
diygod/rsshub:latest1d4b508b6357
undici@6.27.0
6.28.0
1
diygod/rsshub:2025-11-097a6312cac0d5
undici@6.22.0
6.28.0
1
docmost/docmost:0.95.041c8d777cf23
undici@7.28.0
7.29.0
1
drumsergio/lynxprompt:2.0.75c6afb6679301
undici@6.25.0
6.28.0
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
undici@6.27.0
6.28.0
1
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
undici@6.26.0
6.28.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.