CVE-2026-21637

High

Advisory

Published 20 Jan 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.011; 64th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 60; of 17,781 indexed, latest versions
Container images: 53; deployed by those charts
Fix available: 4 of 5; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 60 of 17,781 indexed charts deploy, on 53 images.

Affected package	Affected versions	Fixed in	Images
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+32 more	18.20.4+dfsg-1~deb12u2, 20.19.2+dfsg-1+deb13u2	47
nodejsapk	22.16.0-r2, 24.11.1-r0	22.22.0-r0, 24.14.1-r0	3
nodejs-18apk	18.20.8-r9	no fix listed	1
nodejs-20apk	20.18.3-r0	20.20.0-r0	1
nodejs-25apk	25.2.1-r0	25.3.0-r0	1

OSV records: ALPINE-CVE-2026-21637 DEBIAN-CVE-2026-21637 CGA-49hx-g8q2-c77x CGA-7vx9-vx96-v3cx CGA-qff4-xr3h-wx66 UBUNTU-CVE-2026-21637
Also known as: CGA-5fwr-8cc8-8pp4, CGA-8936-3m7v-3hh2, CGA-qxwp-vgrx-8r42

Charts affected

60 by stars

Chart

Latest

Affected images

Radar Score

coolifyquench-coolify

0.0.17

1 of 4 See more

coolify quench-coolify 0.0.17

1 of the 4 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned	f128e512c9c0	nodejs-18@18.20.8-r9	no fix listed

Open the chart page →

433

coolify-realtimequench-coolify-realtime

0.0.7

1 of 1 See more

coolify-realtime quench-coolify-realtime 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned	f128e512c9c0	nodejs-18@18.20.8-r9	no fix listed

Open the chart page →

306

dgraphromholdings

0.0.20

1 of 1 See more

dgraph romholdings 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
dgraph/dgraph :v21.12.0	3b55ea83fffe	nodejs@14.17.5-deb-1nodesource1	no fix listed

Open the chart page →

11,909

tandoorrtomik-helm-charts

0.0.1

1 of 1 See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
vabene1111/recipes :2.3.5	0f8d061895e9	nodejs@22.16.0-r2	22.22.0-r0

Open the chart page →

4,499

grafanasvtech-public-helm-charts

1.0.0

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	nodejs@10.19.0~dfsg-3ubuntu1.3	no fix listed

Open the chart page →

10,902

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	nodejs@20.20.2-1nodesource1	no fix listed

Open the chart page →

7,248

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	nodejs@20.11.1-1nodesource1	no fix listed

Open the chart page →

9,347

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

28,605

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-21637.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	nodejs@20.15.0-1nodesource1	no fix listed

Open the chart page →

14,100

Container images carrying it

53 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	nodejs@14.17.2-deb-1nodesource1	no fix listed	1
ghcr.io/kagent-dev/doc2vec/mcp :1.1.14	ace1de323f4a	nodejs-25@25.2.1-r0	25.3.0-r0	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	nodejs@18.20.8-1nodesource1	20.19.2+dfsg-1+deb13u2	1