CVE-2026-21713

Medium

Advisory

Published 30 Mar 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.004; 32nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 59; of 17,781 indexed, latest versions
Container images: 52; deployed by those charts
Fix available: 2 of 3; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 52 images.

Affected package	Affected versions	Fixed in	Images
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+32 more	18.20.4+dfsg-1~deb12u2, 20.19.2+dfsg-1+deb13u2	47
nodejsapk	22.16.0-r2, 22.22.0-r0, 24.11.1-r0	22.22.2-r0, 24.14.1-r0	4
nodejs-18apk	18.20.8-r9	no fix listed	1

OSV records: ALPINE-CVE-2026-21713 CGA-7479-r486-84vc DEBIAN-CVE-2026-21713 UBUNTU-CVE-2026-21713
Also known as: CGA-jph8-g9xf-4pjp

Charts affected

59 by stars

Chart

Latest

Affected images

Radar Score

coolify-realtimequench-coolify-realtime

0.0.7

1 of 1 See more

coolify-realtime quench-coolify-realtime 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned	f128e512c9c0	nodejs-18@18.20.8-r9	no fix listed

Open the chart page →

306

dgraphromholdings

0.0.20

1 of 1 See more

dgraph romholdings 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
dgraph/dgraph :v21.12.0	3b55ea83fffe	nodejs@14.17.5-deb-1nodesource1	no fix listed

Open the chart page →

11,909

tandoorrtomik-helm-charts

0.0.1

1 of 1 See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
vabene1111/recipes :2.3.5	0f8d061895e9	nodejs@22.16.0-r2	22.22.2-r0

Open the chart page →

4,499

grafanasvtech-public-helm-charts

1.0.0

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	nodejs@10.19.0~dfsg-3ubuntu1.3	no fix listed

Open the chart page →

10,902

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	nodejs@20.20.2-1nodesource1	no fix listed

Open the chart page →

7,248

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	nodejs@20.11.1-1nodesource1	no fix listed

Open the chart page →

9,347

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

28,605

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-21713.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	nodejs@20.15.0-1nodesource1	no fix listed

Open the chart page →

14,100

Container images carrying it

52 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	nodejs@14.17.2-deb-1nodesource1	no fix listed	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	nodejs@18.20.8-1nodesource1	20.19.2+dfsg-1+deb13u2	1