StackRadar

CVE-2026-16728

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
7th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
222
of 17,781 indexed, latest versions
Container images
203
deployed by those charts
Fix available
1 of 2
affected packages

undici vulnerable to downstream response desynchronization via retry interceptor

Carried by container images the latest versions of 222 of 17,781 indexed charts deploy, on 203 images.

Affected packageAffected versionsFixed inImages
node-undicideb5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4, 5.26.3+dfsg1+~cs23.10.12-2+1 moreno fix listed9
undicinpm4.15.0, 5.6.0, 5.11.0, 5.12.0+41 more6.28.0, 7.29.0, 8.9.0203
OSV records
DEBIAN-CVE-2026-16728GHSA-8xcm-r25x-g524UBUNTU-CVE-2026-16728

Charts affected

222 by stars
ChartLatestAffected imagesRadar Score
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
undici@7.11.0
7.29.0

Open the chart page →

4,251
clickhouse-monitoringduyet0.1.21 of 2See more

clickhouse-monitoring duyet 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
undici@6.26.0
6.28.0

Open the chart page →

1,049
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0

Open the chart page →

9,244
benchmarking-tooleclipse-aeriosVerified publisher1.0.01 of 1See more

benchmarking-tool eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
undici@6.26.0
6.28.0

Open the chart page →

687
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
undici@6.27.0
6.28.0

Open the chart page →

975
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
undici@6.27.0
6.28.0

Open the chart page →

30,159
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
undici@6.25.0
6.28.0

Open the chart page →

1,755
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
undici@6.26.0
6.28.0

Open the chart page →

2,891
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
chainsafe/lodestar:latest5593f6e97912
undici@6.27.0
6.28.0

Open the chart page →

2,522
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.28.0

Open the chart page →

2,266
beeport-uiethersphereVerified publisher0.76.21 of 3See more

beeport-ui ethersphere 0.76.2

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:ltsbe23f54a88d3
undici@6.27.0
6.28.0

Open the chart page →

7,368
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.28.0

Open the chart page →

4,756
multichain-uiethersphereVerified publisher0.73.11 of 3See more

multichain-ui ethersphere 0.73.1

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:ltsbe23f54a88d3
undici@6.27.0
6.28.0

Open the chart page →

7,368
static-siteethersphereVerified publisher0.73.11 of 2See more

static-site ethersphere 0.73.1

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:latestf5d1cc40abc1
undici@6.27.0
6.28.0

Open the chart page →

6,851
evobotevobotVerified publisher0.1.11 of 1See more

evobot evobot 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/evobot:3.0.04ddbb244c82f
undici@5.27.2
6.28.0

Open the chart page →

2,987
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
undici@5.29.0
6.28.0

Open the chart page →

1,847
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
undici@5.15.0
no fix listed
6.28.0

Open the chart page →

13,241
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
undici@5.22.1
6.28.0

Open the chart page →

9,019
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
undici@6.27.0
6.28.0

Open the chart page →

1,053
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0

Open the chart page →

2,682
gtmgtmVerified publisher1.0.21 of 1See more

gtm gtm 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
undici@6.27.0
6.28.0

Open the chart page →

472
crucixhelm-crucix0.2.01 of 1See more

crucix helm-crucix 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/calesthio/crucix:latest67c5244b6acf
undici@7.24.4
7.29.0

Open the chart page →

778
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
undici@6.25.0
6.28.0

Open the chart page →

7,633
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
undici@6.27.0
6.28.0

Open the chart page →

2,463
homarrhelmforgeVerified publisher1.2.81 of 1See more

homarr helmforge 1.2.8

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
undici@6.26.0
6.28.0

Open the chart page →

435
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
undici@6.26.0
6.28.0

Open the chart page →

11,042
matterbridgehelmforgeVerified publisher1.0.21 of 1See more

matterbridge helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
luligu/matterbridge:3.10.81ec50ecd0694
undici@6.27.0
6.28.0

Open the chart page →

895
memoshelmforgeVerified publisher2.0.01 of 2See more

memos helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.23159fe6464903
undici@6.27.0
6.28.0

Open the chart page →

792
opencuthelmforgeVerified publisher1.1.91 of 5See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
undici@6.26.0
6.28.0

Open the chart page →

3,726
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
undici@6.26.0
6.28.0

Open the chart page →

2,538
pocket-idhelmforgeVerified publisher1.0.01 of 2See more

pocket-id helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.23159fe6464903
undici@6.27.0
6.28.0

Open the chart page →

453
reactive-resumehelmforgeVerified publisher1.0.02 of 4See more

reactive-resume helmforge 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:24.21.0-alpinebe80f76cf40e
undici@6.27.0
6.28.0
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
undici@6.27.0
6.28.0

Open the chart page →

3,025
twentyhelmforgeVerified publisher1.0.01 of 5See more

twenty helmforge 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:24.21.0-alpinebe80f76cf40e
undici@6.27.0
6.28.0

Open the chart page →

2,818
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
undici@6.26.0
6.28.0

Open the chart page →

8,967
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
undici@4.15.0
6.28.0

Open the chart page →

4,944
deconzjanip81-helm-chartsVerified publisher0.1.11 of 1See more

deconz janip81-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.29.2062de2362641
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0

Open the chart page →

10,780
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
undici@7.25.0
7.29.0

Open the chart page →

3,436
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
undici@5.28.5
6.28.0

Open the chart page →

5,826
zomboid-serverjanip81-helm-chartsVerified publisher0.1.211 of 3See more

zomboid-server janip81-helm-charts 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/fpsacha/zomboid-panel:v1.0.6605e16dd56cfb
undici@8.5.0
8.9.0

Open the chart page →

424
homebridgejespernohrVerified publisher0.2.01 of 1See more

homebridge jespernohr 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
homebridge/homebridge:latest77c685a40911
undici@6.27.0
6.28.0

Open the chart page →

2,149
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
undici@6.25.0
6.28.0

Open the chart page →

3,092
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
undici@5.22.0
6.28.0

Open the chart page →

9,783
k8s-jacoco-operatork8s-jacoco-operator0.4.01 of 4See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/node:lts-alpinee67514e5d0f6
undici@6.27.0
6.28.0

Open the chart page →

2,437
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
undici@6.21.1
6.28.0

Open the chart page →

5,228
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
kitware/cdash:v5.3.0d7767d9b9da4
undici@6.26.0
6.28.0

Open the chart page →

12,062
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
undici@5.22.1
6.28.0

Open the chart page →

2,178
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
undici@6.25.0
6.28.0

Open the chart page →

2,756
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
undici@6.25.0
6.28.0

Open the chart page →

1,498
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16728.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
undici@7.18.2
7.29.0

Open the chart page →

2,548

Container images carrying it

203 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
epam/ai-dial-admin-frontend:0.20.021d91ad74755
undici@6.26.0
6.28.0
1
epam/ai-dial-chat:0.49.0bd6b13695cdc
undici@6.26.0
6.28.0
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
undici@4.15.0
6.28.0
1
etherpad/etherpad:latest6020e7b57f4b
undici@6.27.0
6.28.0
1
etherpad/etherpad:2.7.2b723fe5f2594
undici@7.25.0
7.29.0
1
ethpandaops/assertoor:latest1efa2fba6711
undici@6.26.0
6.28.0
1
evoapicloud/evolution-api:latest966625532d90
undici@7.16.0
7.29.0
1
fallenbagel/jellyseerr:latest4538137bc5af
undici@7.3.0
7.29.0
1
felddy/foundryvtt:12.343.06c5e3e9ffbb0
undici@6.19.7
6.28.0
1
foggbh/stocky:latest8b7a2e5ecf4e
undici@6.27.0
6.28.0
1
fosrl/pangolin:latest83a55f933b4d
undici@6.26.0
6.28.0
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
undici@7.24.4
7.29.0
1
globalping/globalping-probe:latest8acbd23009fd
undici@5.29.0
6.28.0
1
haohanyang/compass-web:0.5.054f2112602ee
undici@6.25.0
6.28.0
1
haohanyang/compass-web:0.5.1f4f8fe4e21f1
undici@6.27.0
6.28.0
1
helmforge/opencut:v0.3.0bf11156e0ab5
undici@6.26.0
6.28.0
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
undici@6.21.2
6.28.0
1
joplin/server:latest3f7b852959aa
undici@6.27.0
6.28.0
1
journeyapps/powersync-service:latestbf46f66e5dcc
undici@6.26.0
6.28.0
1
jupyterhub/jupyterhub:5.4.63974ba945e65
node-undici@5.26.3+dfsg1+~cs23.10.12-2
undici@5.26.3
no fix listed
6.28.0
1
kitware/cdash:v5.3.0d7767d9b9da4
undici@6.26.0
6.28.0
1
kubebb/component-store:latestfd8ecbd73213
undici@5.22.1
6.28.0
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
undici@6.27.0
6.28.0
1
langgenius/dify-api:1.0.0066035f93856
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0
1
langgenius/dify-api:0.6.11fca918260dd6
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3
undici@5.15.0
no fix listed
6.28.0
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
undici@6.26.0
6.28.0
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
undici@6.26.0
6.28.0
1
library/ghost:6.37.01ef2e532ca4d
undici@7.25.0
7.29.0
1
library/ghost:6.25.12654b1e90413
undici@5.22.1
6.28.0
1
library/ghost:6.41.129773d6be407
undici@6.25.0
6.28.0
1
library/ghost:6.39.0-alpine77196da4b0df
undici@6.25.0
6.28.0
1
library/ghost:5.79.083f7bf209844
undici@5.22.1
6.28.0
1
library/ghost:6.62.0a7a268bbfb7f
undici@6.27.0
6.28.0
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
undici@5.22.1
6.28.0
1
library/kibana:8.18.004c0fc150f3a
undici@6.19.2
6.28.0
1
library/node:lts-alpinee67514e5d0f6
undici@6.27.0
6.28.0
1
library/node:latestf5d1cc40abc1
undici@6.27.0
6.28.0
1
louislam/uptime-kuma:2.2.1-slim059b49d64739
undici@6.23.0
6.28.0
1
louislam/uptime-kuma:2.0.24c364ef96aad
undici@6.22.0
6.28.0
1
louislam/uptime-kuma:2.4.091e963bfda56
undici@6.26.0
6.28.0
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
undici@6.22.0
6.28.0
1
luligu/matterbridge:3.10.81ec50ecd0694
undici@6.27.0
6.28.0
1
mautic/mautic:7-apacheeb8cc73d97e1
undici@6.26.0
6.28.0
1
n8nio/n8n:2.25.7761374d4eb84
undici@7.24.6
7.29.0
1
n8nio/n8n:1.86.08b39ed5a2de9
undici@5.28.5
6.28.0
1
n8nio/n8n:2.36.8cfe2704ff858
undici@6.27.0
6.28.0
1
n8nio/n8n:1.33.1dd171d45102a
undici@6.9.0
6.28.0
1
neoskop/ixy:2.1.125152b474f54
undici@6.27.0
6.28.0
1
nocodb/nocodb:0.301.5d9516f0bf546
undici@7.24.4
7.29.0
1
nodered/node-red:5.0.410f40d0a83e7
undici@6.27.0
6.28.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.