StackRadarChart IndexLive demo

CVE-2026-25547

Critical

Advisory

Published 3 Feb 2026In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.2; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 34; of 17,781 indexed, latest versions
Container images: 30; deployed by those charts
Fix available: 1 of 2; affected packages

@isaacs/brace-expansion has Uncontrolled Resource Consumption

Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 30 images.

Affected package	Affected versions	Fixed in	Images
node-brace-expansiondeb	1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1, 2.0.1+~1.1.0-2	no fix listed	6
@isaacs/brace-expansionnpm	5.0.0	5.0.1	24

OSV records: DEBIAN-CVE-2026-25547 UBUNTU-CVE-2026-25547 GHSA-7h2j-956f-4vf2

Charts affected

34 by stars

Chart

Latest

Affected images

Radar Score

ilumilum

1 of 19 See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ilum/ui :6.7.3	998937726679	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

23,228

openhabhelmforge

1 of 1 See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
openhab/openhab :5.2.1	bfd4a60e90da	node-brace-expansion@2.0.1+~1.1.0-2	no fix listed

Open the chart page →

3,641

huehue

1 of 3 See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
gethue/hue :latest	7d5c1b9f8a79	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

12,397

immichimmich-helm

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

15,712

kube-ingress-dash-chartkube-ingress-dash

1 of 1 See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

1,505

prowlerprowler-app

1 of 5 See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

8,158

linkwardenadnoctem

1 of 2 See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

3,820

bluerange-mosquittobluerange

1 of 1 See more

bluerange-mosquitto bluerange 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
bluerange/bluerange-mosquitto :25	f1bfbba84832	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

1,168

openmctbryopsida

1 of 1 See more

openmct bryopsida 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/openmct :main	38b6a50a62b2	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

951

otbrcharts-derwitt-dev

1 of 1 See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
openthread/otbr :latest	f307f59f6432	node-brace-expansion@1.1.8-1	no fix listed

Open the chart page →

12,779

codehubcodehub

1 of 5 See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
jupyterhub/jupyterhub :5.4.6	3974ba945e65	node-brace-expansion@2.0.1+~1.1.0-1	no fix listed

Open the chart page →

13,220

devtron-enterprisedevtron

1 of 28 See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

68,240

devtron-enterprisedevtron-labs

1 of 28 See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

68,240

dumpstoredumpstore

1 of 2 See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

4,251

lodestarethereum-helm-charts

1 of 2 See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
chainsafe/lodestar :latest	5593f6e97912	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

2,522

ryothelmforge

1 of 2 See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

6,012

ilum-marquezilum

1 of 3 See more

ilum-marquez ilum 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ilum/marquez-web :0.53.2	716437a51a6c	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

6,254

1 of 2 See more

ilum-ui ilum 6.7.3

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ilum/ui :6.7.3	998937726679	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

1,235

github-exporterjkroepke

1 of 1 See more

github-exporter jkroepke 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
jkroepke/github_exporter :1.8.0	3d850992786d	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

1,031

k8s-jacoco-operatork8s-jacoco-operator

1 of 4 See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/curium-rocks/k8s-jacoco-operator :main	a558ceae6cdb	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

2,437

pangolinkrzwiatrzyk

1 of 1 See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
fosrl/pangolin :1.13.0	c32ad797ab96	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

3,441

zigbee2mqttlmatfy

1 of 2 See more

zigbee2mqtt lmatfy 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
koenkk/zigbee2mqtt :2.7.2	60a295b40f4e	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

1,391

nublado2lsst-sqre

1 of 2 See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	node-brace-expansion@1.1.11-1	no fix listed

Open the chart page →

17,779

bofmojaloop

1 of 1 See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

2,457

security-role-perm-operator-svcmojaloop

1 of 1 See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

2,457

raspberrymaticopenccu

1 of 1 See more

raspberrymatic openccu 3.83.6

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

2,421

openwhiskopenwhisk

1 of 10 See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
openwhisk/ow-utils :1.0.0	c80dba0de3aa	node-brace-expansion@1.1.8-1	no fix listed

Open the chart page →

36,215

pairdroppascaliske

1 of 1 See more

pairdrop pascaliske 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/pairdrop :version-v1.11.2	3279d2d986c0	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

663

readability-js-serverreadability-js-server

1 of 1 See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
phpdockerio/readability-js-server :1.8.0	ea8354b42600	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

1,858

devtron-enterpriseromholdings

1 of 28 See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

68,240

counter-dhlsikademo

1 of 3 See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
ghcr.io/ondrejsika/counter-frontend :latest	c4166d2eb8eb	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

4,820

grafanasvtech-public-helm-charts

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	node-brace-expansion@1.1.11-1	no fix listed

Open the chart page →

10,902

tensorzerotensorzero

1 of 2 See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
tensorzero/ui :2026.6.0	f2563d54724e	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

3,972

joplintobiassackmann

1 of 2 See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-25547.

Container image	Digest	Package	Fixed in
joplin/server :latest	3f7b852959aa	@isaacs/brace-expansion@5.0.0	5.0.1

Open the chart page →

5,535

Container images carrying it

30 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	@isaacs/brace-expansion@5.0.0	5.0.1	3
ilum/ui :6.7.3	998937726679	@isaacs/brace-expansion@5.0.0	5.0.1	2
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	@isaacs/brace-expansion@5.0.0	5.0.1	2
bluerange/bluerange-mosquitto :25	f1bfbba84832	@isaacs/brace-expansion@5.0.0	5.0.1	1
chainsafe/lodestar :latest	5593f6e97912	@isaacs/brace-expansion@5.0.0	5.0.1	1
fosrl/pangolin :1.13.0	c32ad797ab96	@isaacs/brace-expansion@5.0.0	5.0.1	1
gethue/hue :latest	7d5c1b9f8a79	@isaacs/brace-expansion@5.0.0	5.0.1	1
ilum/marquez-web :0.53.2	716437a51a6c	@isaacs/brace-expansion@5.0.0	5.0.1	1
jkroepke/github_exporter :1.8.0	3d850992786d	@isaacs/brace-expansion@5.0.0	5.0.1	1
joplin/server :latest	3f7b852959aa	@isaacs/brace-expansion@5.0.0	5.0.1	1
jupyterhub/jupyterhub :5.4.6	3974ba945e65	node-brace-expansion@2.0.1+~1.1.0-1	no fix listed	1
koenkk/zigbee2mqtt :2.7.2	60a295b40f4e	@isaacs/brace-expansion@5.0.0	5.0.1	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	node-brace-expansion@1.1.11-1	no fix listed	1
openhab/openhab :5.2.1	bfd4a60e90da	node-brace-expansion@2.0.1+~1.1.0-2	no fix listed	1
openthread/otbr :latest	f307f59f6432	node-brace-expansion@1.1.8-1	no fix listed	1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	node-brace-expansion@1.1.8-1	no fix listed	1
phpdockerio/readability-js-server :1.8.0	ea8354b42600	@isaacs/brace-expansion@5.0.0	5.0.1	1
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	@isaacs/brace-expansion@5.0.0	5.0.1	1
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	node-brace-expansion@1.1.11-1	no fix listed	1
tensorzero/ui :2026.6.0	f2563d54724e	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/bryopsida/openmct :main	38b6a50a62b2	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/curium-rocks/k8s-jacoco-operator :main	a558ceae6cdb	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/linuxserver/pairdrop :version-v1.11.2	3279d2d986c0	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/ondrejsika/counter-frontend :latest	c4166d2eb8eb	@isaacs/brace-expansion@5.0.0	5.0.1	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	@isaacs/brace-expansion@5.0.0	5.0.1	1