StackRadar

CVE-2026-26278

High

Advisory

Published 17 Feb 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
56th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 17,781 indexed, latest versions
Container images
79
deployed by those charts
Fix available
1 of 1
affected package

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Carried by container images the latest versions of 79 of 17,781 indexed charts deploy, on 79 images.

Affected packageAffected versionsFixed inImages
fast-xml-parsernpm4.2.5, 4.2.6, 4.3.5, 4.3.6+8 more4.5.4, 5.3.679
OSV records
GHSA-jmr7-xgp7-cmfj

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

5,352
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
supabase/storage-api:v1.12.0f983fb50bd95
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

23,123
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
fast-xml-parser@4.3.5
4.5.4

Open the chart page →

5,639
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

4,285
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

2,654
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
fast-xml-parser@4.2.5
4.5.4
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

28,839
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/data-fair/notify:3c739b74dabb0
fast-xml-parser@4.5.3
4.5.4
ghcr.io/data-fair/processings:15a9216989707
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

38,346
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

11,458
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

4,196
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
fast-xml-parser@5.2.1
5.3.6

Open the chart page →

5,228
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
chibisafe/chibisafe-server:latest3da4fcbc1a18
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

5,654
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

13,738
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
fast-xml-parser@4.5.3
4.5.4

Open the chart page →

6,873
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

6,883
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
fast-xml-parser@4.5.3
4.5.4

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

38,107
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

5,213
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
fast-xml-parser@4.5.3
4.5.4

Open the chart page →

10,380
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

1,055
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

3,820
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
fast-xml-parser@4.4.0
4.5.4

Open the chart page →

3,437
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
fast-xml-parser@5.3.4
5.3.6

Open the chart page →

2,136
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

4,083
countlychristianhuthVerified publisher5.2.12 of 3See more

countly christianhuth 5.2.1

2 of the 3 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
fast-xml-parser@4.3.6
4.5.4
countly/frontend:25.05.42acbc11499b6
fast-xml-parser@4.3.6
4.5.4

Open the chart page →

7,295
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
fast-xml-parser@4.4.1
4.5.4
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
fast-xml-parser@5.2.5
5.3.6
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

18,293
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

3,769
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

4,551
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

4,217
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

2,862
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:13d632903e6af
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

3,474
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
fast-xml-parser@5.0.9
5.3.6

Open the chart page →

2,950
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

666
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
fast-xml-parser@4.5.0
4.5.4

Open the chart page →

5,769
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
fast-xml-parser@4.3.6
4.5.4

Open the chart page →

18,813
croniclehelmforgeVerified publisher1.1.101 of 1See more

cronicle helmforge 1.1.10

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
soulteary/cronicle:0.9.80ac2512fa6e39
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

1,271
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

5,826
image-storage-servicejtektVerified publisher0.4.31 of 4See more

image-storage-service jtekt 0.4.3

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

22,589
shinsei-managerjtektVerified publisher0.2.01 of 8See more

shinsei-manager jtekt 0.2.0

1 of the 8 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

63,461
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.3.6

Open the chart page →

5,228
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

9,098
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

3,441
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

1,378
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

6,356
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
fast-xml-parser@4.5.3
4.5.4

Open the chart page →

3,555
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

33,242
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.3.6

Open the chart page →

33,242
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

9,774
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
fast-xml-parser@4.2.5
4.5.4

Open the chart page →

9,668
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
fast-xml-parser@4.4.1
4.5.4

Open the chart page →

43,341
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-26278.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
fast-xml-parser@4.5.3
4.5.4

Open the chart page →

2,457

Container images carrying it

79 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
supabase/storage-api:v1.12.0f983fb50bd95
fast-xml-parser@4.4.1
4.5.4
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
fast-xml-parser@4.2.5
4.5.4
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
fast-xml-parser@4.4.1
4.5.4
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
fast-xml-parser@5.3.4
5.3.6
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
fast-xml-parser@4.4.1
4.5.4
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
fast-xml-parser@5.0.9
5.3.6
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
fast-xml-parser@4.4.1
4.5.4
1
ghcr.io/data-fair/notify:3c739b74dabb0
fast-xml-parser@4.5.3
4.5.4
1
ghcr.io/data-fair/processings:15a9216989707
fast-xml-parser@4.2.5
4.5.4
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
fast-xml-parser@4.5.3
4.5.4
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
fast-xml-parser@4.4.1
4.5.4
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
fast-xml-parser@4.4.1
4.5.4
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
fast-xml-parser@4.4.1
4.5.4
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
fast-xml-parser@4.2.5
4.5.4
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
fast-xml-parser@4.2.5
4.5.4
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
fast-xml-parser@4.2.5
4.5.4
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.3.6
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-xml-parser@5.2.5
5.3.6
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
fast-xml-parser@4.5.3
4.5.4
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
fast-xml-parser@4.2.5
4.5.4
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-xml-parser@4.2.5
4.5.4
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
fast-xml-parser@4.2.5
4.5.4
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
fast-xml-parser@4.2.5
4.5.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.