StackRadar

CVE-2026-16729

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
222
of 17,781 indexed, latest versions
Container images
203
deployed by those charts
Fix available
1 of 2
affected packages

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

Carried by container images the latest versions of 222 of 17,781 indexed charts deploy, on 203 images.

Affected packageAffected versionsFixed inImages
node-undicideb5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3, 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4, 5.26.3+dfsg1+~cs23.10.12-2+1 moreno fix listed9
undicinpm4.15.0, 5.6.0, 5.11.0, 5.12.0+41 more6.28.0, 7.29.0, 8.9.0203
OSV records
DEBIAN-CVE-2026-16729GHSA-v3r7-h72x-cjcmUBUNTU-CVE-2026-16729

Charts affected

222 by stars
ChartLatestAffected imagesRadar Score
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
undici@7.11.0
7.29.0

Open the chart page →

4,251
clickhouse-monitoringduyet0.1.21 of 2See more

clickhouse-monitoring duyet 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
undici@6.26.0
6.28.0

Open the chart page →

1,049
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0

Open the chart page →

9,244
benchmarking-tooleclipse-aeriosVerified publisher1.0.01 of 1See more

benchmarking-tool eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
undici@6.26.0
6.28.0

Open the chart page →

687
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
undici@6.27.0
6.28.0

Open the chart page →

975
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
undici@6.27.0
6.28.0

Open the chart page →

30,159
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
undici@6.25.0
6.28.0

Open the chart page →

1,755
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
undici@6.26.0
6.28.0

Open the chart page →

2,891
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
chainsafe/lodestar:latest5593f6e97912
undici@6.27.0
6.28.0

Open the chart page →

2,522
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.28.0

Open the chart page →

2,266
beeport-uiethersphereVerified publisher0.76.21 of 3See more

beeport-ui ethersphere 0.76.2

1 of the 3 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:ltsbe23f54a88d3
undici@6.27.0
6.28.0

Open the chart page →

7,368
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.28.0

Open the chart page →

4,756
multichain-uiethersphereVerified publisher0.73.11 of 3See more

multichain-ui ethersphere 0.73.1

1 of the 3 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:ltsbe23f54a88d3
undici@6.27.0
6.28.0

Open the chart page →

7,368
static-siteethersphereVerified publisher0.73.11 of 2See more

static-site ethersphere 0.73.1

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:latestf5d1cc40abc1
undici@6.27.0
6.28.0

Open the chart page →

6,851
evobotevobotVerified publisher0.1.11 of 1See more

evobot evobot 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/evobot:3.0.04ddbb244c82f
undici@5.27.2
6.28.0

Open the chart page →

2,987
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
undici@5.29.0
6.28.0

Open the chart page →

1,847
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
undici@5.15.0
no fix listed
6.28.0

Open the chart page →

13,241
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
undici@5.22.1
6.28.0

Open the chart page →

9,019
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
undici@6.27.0
6.28.0

Open the chart page →

1,053
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0

Open the chart page →

2,682
gtmgtmVerified publisher1.0.21 of 1See more

gtm gtm 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
undici@6.27.0
6.28.0

Open the chart page →

472
crucixhelm-crucix0.2.01 of 1See more

crucix helm-crucix 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/calesthio/crucix:latest67c5244b6acf
undici@7.24.4
7.29.0

Open the chart page →

778
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
undici@6.25.0
6.28.0

Open the chart page →

7,633
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
undici@6.27.0
6.28.0

Open the chart page →

2,463
homarrhelmforgeVerified publisher1.2.81 of 1See more

homarr helmforge 1.2.8

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
undici@6.26.0
6.28.0

Open the chart page →

435
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
undici@6.26.0
6.28.0

Open the chart page →

11,042
matterbridgehelmforgeVerified publisher1.0.21 of 1See more

matterbridge helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
luligu/matterbridge:3.10.81ec50ecd0694
undici@6.27.0
6.28.0

Open the chart page →

895
memoshelmforgeVerified publisher2.0.01 of 2See more

memos helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.23159fe6464903
undici@6.27.0
6.28.0

Open the chart page →

792
opencuthelmforgeVerified publisher1.1.91 of 5See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
undici@6.26.0
6.28.0

Open the chart page →

3,726
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
undici@6.26.0
6.28.0

Open the chart page →

2,538
pocket-idhelmforgeVerified publisher1.0.01 of 2See more

pocket-id helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.23159fe6464903
undici@6.27.0
6.28.0

Open the chart page →

453
reactive-resumehelmforgeVerified publisher1.0.02 of 4See more

reactive-resume helmforge 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:24.21.0-alpinebe80f76cf40e
undici@6.27.0
6.28.0
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
undici@6.27.0
6.28.0

Open the chart page →

3,025
twentyhelmforgeVerified publisher1.0.01 of 5See more

twenty helmforge 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:24.21.0-alpinebe80f76cf40e
undici@6.27.0
6.28.0

Open the chart page →

2,818
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
undici@6.26.0
6.28.0

Open the chart page →

8,967
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
undici@4.15.0
6.28.0

Open the chart page →

4,944
deconzjanip81-helm-chartsVerified publisher0.1.11 of 1See more

deconz janip81-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.29.2062de2362641
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0

Open the chart page →

10,780
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
undici@7.25.0
7.29.0

Open the chart page →

3,436
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
undici@5.28.5
6.28.0

Open the chart page →

5,826
zomboid-serverjanip81-helm-chartsVerified publisher0.1.211 of 3See more

zomboid-server janip81-helm-charts 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/fpsacha/zomboid-panel:v1.0.6605e16dd56cfb
undici@8.5.0
8.9.0

Open the chart page →

424
homebridgejespernohrVerified publisher0.2.01 of 1See more

homebridge jespernohr 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
homebridge/homebridge:latest77c685a40911
undici@6.27.0
6.28.0

Open the chart page →

2,149
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
undici@6.25.0
6.28.0

Open the chart page →

3,092
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
undici@5.22.0
6.28.0

Open the chart page →

9,783
k8s-jacoco-operatork8s-jacoco-operator0.4.01 of 4See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/node:lts-alpinee67514e5d0f6
undici@6.27.0
6.28.0

Open the chart page →

2,437
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
undici@6.21.1
6.28.0

Open the chart page →

5,228
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
kitware/cdash:v5.3.0d7767d9b9da4
undici@6.26.0
6.28.0

Open the chart page →

12,062
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
undici@5.22.1
6.28.0

Open the chart page →

2,178
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
undici@6.25.0
6.28.0

Open the chart page →

2,756
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
undici@6.25.0
6.28.0

Open the chart page →

1,498
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16729.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
undici@7.18.2
7.29.0

Open the chart page →

2,548

Container images carrying it

203 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
library/node:ltsbe23f54a88d3
undici@6.27.0
6.28.0
3
localstack/localstack-pro:latest4aef81c53168
undici@6.27.0
6.28.0
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.28.0
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
undici@6.25.0
6.28.0
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.28.0
3
actualbudget/actual-server:26.9.0552beab3dec8
undici@6.27.0
6.28.0
2
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.28.0
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
undici@5.28.4
6.28.0
2
homebridge/homebridge:latest77c685a40911
undici@6.27.0
6.28.0
2
library/ghost:6.63.0e05bc1169fb2
undici@6.27.0
6.28.0
2
library/node:24.21.0-alpine3.23159fe6464903
undici@6.27.0
6.28.0
2
library/node:24.21.0-alpinebe80f76cf40e
undici@6.27.0
6.28.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
undici@6.25.0
6.28.0
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
undici@6.27.0
6.28.0
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
undici@7.11.0
7.29.0
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
undici@7.10.0
7.29.0
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
undici@7.16.0
7.29.0
2
n8nio/n8n:2.36.714c4285bc303
undici@6.27.0
6.28.0
2
patrikx3/p3x-redis-ui:latestf19eb45b0694
undici@6.27.0
6.28.0
2
rajnandan1/kener:3.2.1930407afca731
undici@6.21.1
6.28.0
2
requarks/wiki:2:latest68f0d1848261
undici@6.25.0
6.28.0
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
undici@6.26.0
6.28.0
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
undici@5.22.0
6.28.0
2
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
undici@6.27.0
6.28.0
2
ghcr.io/api7/adc:0.27.1f65f53dd9668
undici@6.25.0
6.28.0
2
ghcr.io/libredb/libredb-studio:0.15.04b696f960ac1
undici@6.27.0
6.28.0
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
undici@6.26.0
6.28.0
2
aaronshaf/dynamodb-admin:latestac41724cd997
undici@6.25.0
6.28.0
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
undici@7.24.1
7.29.0
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
undici@5.28.3
6.28.0
1
archivebox/archivebox:0.7.41a5a37331091
undici@6.25.0
6.28.0
1
budibase/apps:3.41.344fe6feab985
undici@6.21.3
6.28.0
1
catalysm/csmm:latestf003b35f54d9
undici@5.29.0
6.28.0
1
chainsafe/lodestar:latest5593f6e97912
undici@6.27.0
6.28.0
1
chatwoot/chatwoot:v4.15.167ebc751c171
undici@6.25.0
6.28.0
1
chocobozzz/peertube:v8.1.5052712130691
undici@6.24.1
6.28.0
1
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
undici@6.26.0
6.28.0
1
cryptexlabs/authf:0.12.11189c07411d7c
undici@6.19.8
6.28.0
1
cspconsole/report-processor:1.0.279a2d8840bfdf
undici@5.29.0
6.28.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
undici@6.26.0
6.28.0
1
deconzcommunity/deconz:2.29.2062de2362641
node-undici@5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
undici@5.15.0
no fix listed
6.28.0
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
undici@6.26.0
6.28.0
1
directus/directus:12.0.29c8470ea465c
undici@7.24.5
7.29.0
1
directus/directus:11.1.0e3c8bb975350
undici@6.19.5
6.28.0
1
diygod/rsshub:latest1d4b508b6357
undici@6.27.0
6.28.0
1
diygod/rsshub:2025-11-097a6312cac0d5
undici@6.22.0
6.28.0
1
docmost/docmost:0.95.041c8d777cf23
undici@7.28.0
7.29.0
1
drumsergio/lynxprompt:2.0.75c6afb6679301
undici@6.25.0
6.28.0
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
undici@6.27.0
6.28.0
1
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
undici@6.26.0
6.28.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.