StackRadar

CVE-2026-2391

Low

Advisory

Published 12 Feb 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
485
of 17,781 indexed, latest versions
Container images
485
deployed by those charts
Fix available
1 of 2
affected packages

qs's arrayLimit bypass in comma parsing allows denial of service

Carried by container images the latest versions of 485 of 17,781 indexed charts deploy, on 485 images.

Affected packageAffected versionsFixed inImages
qsnpm6.7.0, 6.8.0, 6.9.1, 6.9.3+16 more6.14.2482
node-qsdeb2.2.4-1, 2.2.4-1ubuntu1, 6.9.1+ds-1no fix listed5
OSV records
GHSA-w7fw-mjwx-w883UBUNTU-CVE-2026-2391

Charts affected

485 by stars
ChartLatestAffected imagesRadar Score
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
qs@6.7.0
6.14.2

Open the chart page →

24,488
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
thingsboard/tb-web-ui:3.6.0d388378062cc
qs@6.10.3
6.14.2

Open the chart page →

14,566
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
thmmniii/fbs-qcm-backend:v1.27.1afbe511e5c24
qs@6.13.0
6.14.2

Open the chart page →

28,534
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
qs@6.7.0
6.14.2

Open the chart page →

2,851
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
qs@6.14.1
6.14.2

Open the chart page →

1,044
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
qs@6.9.4
6.14.2

Open the chart page →

17,896
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
qs@6.11.0
6.14.2

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
qs@6.11.0
6.14.2

Open the chart page →

77,687
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
qs@6.14.1
6.14.2

Open the chart page →

1,991
actualbeluga-cloudVerified publisher2.0.01 of 1See more

actual beluga-cloud 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/actual/actualserver:23.12.1c8a0d5ec5a12
qs@6.11.0
6.14.2

Open the chart page →

1,262
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
qs@6.10.4
6.14.2

Open the chart page →

1,843
maildevchristianhuthVerified publisher1.6.01 of 1See more

maildev christianhuth 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
maildev/maildev:2.2.1180ef51f65ee
qs@6.13.0
6.14.2

Open the chart page →

1,143
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
qs@6.11.0
6.14.2

Open the chart page →

1,341
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
qs@6.9.4
6.14.2

Open the chart page →

9,971
data-fairdata354-helmVerified publisher1.1.25 of 12See more

data-fair data354-helm 1.1.2

5 of the 12 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
qs@6.11.0
6.14.2
ghcr.io/data-fair/metrics:0a8d40779eeae
qs@6.10.3
6.14.2
ghcr.io/data-fair/notify:3c739b74dabb0
qs@6.13.0
6.14.2
ghcr.io/data-fair/processings:15a9216989707
qs@6.11.0
6.14.2
ghcr.io/data-fair/simple-directory:438a4f32fad82
qs@6.10.3
6.14.2

Open the chart page →

38,346
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
qs@6.11.0
6.14.2

Open the chart page →

5,056
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
qs@6.11.0
6.14.2

Open the chart page →

3,925
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
qs@6.13.0
6.14.2

Open the chart page →

5,670
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
qs@6.13.0
6.14.2

Open the chart page →

31,510
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
qs@6.11.0
6.14.2

Open the chart page →

11,458
recaptcha-v3-verifierf3k-techVerified publisher1.110.01 of 1See more

recaptcha-v3-verifier f3k-tech 1.110.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
f3ktech/recaptcha-v3-verifier:1.1.048e78987cf91
qs@6.14.0
6.14.2

Open the chart page →

1,208
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
qs@6.7.0
6.14.2

Open the chart page →

2,519
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
qs@6.9.7
6.14.2

Open the chart page →

4,260
magic-mirrorgeek-cookbookVerified publisher4.4.21 of 1See more

magic-mirror geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
qs@6.7.0
6.14.2

Open the chart page →

4,405
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
qs@6.7.0
6.14.2

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
qs@6.7.0
6.14.2

Open the chart page →

7,801
sendgeek-cookbookVerified publisher1.2.21 of 1See more

send geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
qs@6.10.3
6.14.2

Open the chart page →

1,148
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
qs@6.9.7
6.14.2

Open the chart page →

5,079
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
qs@6.7.0
6.14.2

Open the chart page →

4,410
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
qs@6.11.0
6.14.2

Open the chart page →

4,196
pdc-portali4trustVerified publisher2.3.21 of 1See more

pdc-portal i4trust 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
i4trust/pdc-portal:2.0.03e77858e1219
qs@6.7.0
6.14.2

Open the chart page →

2,723
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
qs@6.14.0
6.14.2

Open the chart page →

15,712
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
qs@6.7.0
6.14.2

Open the chart page →

3,369
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
qs@6.13.0
6.14.2

Open the chart page →

5,228
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
qs@6.9.7
6.14.2

Open the chart page →

3,143
lifecycle-jira-integrationlifecycle-jira-integration1.0.01 of 1See more

lifecycle-jira-integration lifecycle-jira-integration 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
anoopnair/lifecycle-jira-integration:latestd80c73a6089d
qs@6.9.7
6.14.2

Open the chart page →

927
litlyxlitlyx0.2.02 of 5See more

litlyx litlyx 0.2.0

2 of the 5 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
litlyx/litlyx-consumer:latest02225e77d316
qs@6.13.0
6.14.2
litlyx/litlyx-producer:latest10407f36613f
qs@6.13.0
6.14.2

Open the chart page →

7,874
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
qs@6.7.0
6.14.2

Open the chart page →

5,940
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-server:1.0.53c840aebce22
qs@6.7.0
6.14.2

Open the chart page →

19,187
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
qs@6.13.0
6.14.2

Open the chart page →

13,738
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
qs@6.11.0
6.14.2

Open the chart page →

5,300
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
qs@6.11.0
6.14.2

Open the chart page →

2,473
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
qs@6.13.0
6.14.2

Open the chart page →

6,873
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
qs@6.13.0
6.14.2

Open the chart page →

6,883
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
qs@6.13.0
6.14.2

Open the chart page →

2,083
pdf-editor-helmpdf-editor-web1.0.01 of 4See more

pdf-editor-helm pdf-editor-web 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
qs@6.9.3
6.14.2

Open the chart page →

4,206
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
qs@6.7.0
6.14.2

Open the chart page →

31,844
pumejwebapppumejnodejswebapp0.1.01 of 1See more

pumejwebapp pumejnodejswebapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
pumejlab/nodejs-webapp:latestf563eabcb819
qs@6.11.0
6.14.2

Open the chart page →

1,164
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
qs@6.7.0
6.14.2

Open the chart page →

2,449
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-2391.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
qs@6.13.0
6.14.2

Open the chart page →

2,823

Container images carrying it

485 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
conduction/conduction-ui-app:devd591f5e6f2a9
qs@6.7.0
6.14.2
1
countly/api:25.05.4f4cc7447c4f5
qs@6.11.0
6.14.2
1
countly/countly-server:25.05.4e3c238248f99
qs@6.11.0
6.14.2
1
countly/frontend:25.05.42acbc11499b6
qs@6.11.0
6.14.2
1
cryptexlabs/authf:0.12.11189c07411d7c
qs@6.13.0
6.14.2
1
dacinfomotion/h2p:latest68fa393b472c
qs@6.11.0
6.14.2
1
danny1dockerhub/nodejswebapp:lateste434683fcc89
qs@6.11.0
6.14.2
1
datarhei/restreamer:0.6.4655e12f9eeed
qs@6.7.0
6.14.2
1
davdiv/musicociel:deva85f99be882c
qs@6.11.0
6.14.2
1
davidvmar/urjc-davidvmar-server:1.0.05663f5b24615
qs@6.7.0
6.14.2
1
decayofmind/hubot:3.3.21e18e92fe694
qs@6.7.0
6.14.2
1
defactops/defactops-backend:1.0.2307b663c0092a
qs@6.11.0
6.14.2
1
denisshav/backend:latest4cc8dc5a4499
qs@6.7.0
6.14.2
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
qs@6.13.0
6.14.2
1
devravinder/node-express-app:1.0.05325a96967b5
qs@6.13.0
6.14.2
1
devspacecloud/ui:0.3.3deef55ff29a7
qs@6.7.0
6.14.2
1
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
qs@6.9.3
6.14.2
1
directus/directus:11.1.0e3c8bb975350
qs@6.13.0
6.14.2
1
diygod/rsshub:2025-11-097a6312cac0d5
qs@6.14.0
6.14.2
1
documenso/documenso:v1.8.17f16a9449f18
qs@6.11.2
6.14.2
1
eameti/node-app:latestf36642affa86
qs@6.11.0
6.14.2
1
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
qs@6.13.0
6.14.2
1
eclipseaerios/self-orchestrator:1.2.08b123bec5679
qs@6.13.0
6.14.2
1
enketo/enketo-express:3.0.4dcad9c2273f6
qs@6.7.0
6.14.2
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
node-qs@2.2.4-1
no fix listed
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
qs@6.11.0
6.14.2
1
ethersphere/bzz-token-service:latest7624f11a72ad
qs@6.7.0
6.14.2
1
ethersphere/multichain-proxy:0.0.261f5419afbcd
qs@6.13.0
6.14.2
1
ethersphere/onboarding-faucet:0.3.0513154aab230
qs@6.10.3
6.14.2
1
evoapicloud/evolution-api:latest966625532d90
qs@6.13.0
6.14.2
1
f3ktech/recaptcha-v3-verifier:1.1.048e78987cf91
qs@6.14.0
6.14.2
1
fallenbagel/jellyseerr:latest4538137bc5af
qs@6.14.0
6.14.2
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
qs@6.11.0
6.14.2
1
fanzynoodle/smeejas:0.0.15f9916c1a287
qs@6.10.2
6.14.2
1
felipecs8/app-movies-series:v14e51693fcdf5
qs@6.13.0
6.14.2
1
felipecs8/conversor-temperatura:v1f945423be36d
qs@6.10.3
6.14.2
1
felipecs8/landing-page:v1db6d44e325a1
qs@6.13.0
6.14.2
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
qs@6.11.0
6.14.2
1
fiware/idm:8.3.3a1b6ed4ae84f
qs@6.11.0
6.14.2
1
fiware/iotagent-json:3.1.0879b21a0d36d
qs@6.10.3
6.14.2
1
fiware/iotagent-ul:1.14.0fe11f55a926d
qs@6.7.0
6.14.2
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
qs@6.11.2
6.14.2
1
folioci/mod-graphql:latestf0655a6a08fd
qs@6.13.0
6.14.2
1
fonoster/routr-registry:2.13.6e27001f2813c
qs@6.13.0
6.14.2
1
fosrl/pangolin:1.13.0c32ad797ab96
qs@6.14.0
6.14.2
1
frappe/frappe-socketio:v13.4.12095767a9e82
qs@6.7.0
6.14.2
1
getferdi/ferdi-server:1.3.26e620b85afaa
qs@6.8.0
6.14.2
1
glenndehaan/api-mapper:latest6ff6310683bf
qs@6.11.0
6.14.2
1
glenndehaan/contentbridge:latest99b9e4f73848
qs@6.11.0
6.14.2
1
glenndehaan/kube-hook:latest0a7116f48bfe
qs@6.13.0
6.14.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.