StackRadar

CVE-2026-2739

Medium

Advisory

Published 20 Feb 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 17,781 indexed, latest versions
Container images
114
deployed by those charts
Fix available
1 of 1
affected package

bn.js affected by an infinite loop

Carried by container images the latest versions of 127 of 17,781 indexed charts deploy, on 114 images.

Affected packageAffected versionsFixed inImages
bn.jsnpm4.11.6, 4.11.8, 4.11.9, 4.12.0+6 more4.12.3, 5.2.3114
OSV records
GHSA-378v-28hj-76wf

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
bn.js@5.1.3
5.2.3

Open the chart page →

27,465
raspberrymaticopenccuVerified publisher3.83.61 of 1See more

raspberrymatic openccu 3.83.6

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
bn.js@4.12.2
4.12.3

Open the chart page →

2,421
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
bn.js@4.12.0
4.12.3

Open the chart page →

9,968
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
bn.js@4.12.0
4.12.3

Open the chart page →

6,524
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
bn.js@4.12.0
4.12.3

Open the chart page →

6,026
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
bn.js@5.1.1
5.2.3

Open the chart page →

5,215
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
bn.js@5.2.0
5.2.3

Open the chart page →

7,413
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
gjeanmart/safe-ganache-node:latest926264c8f2d1
bn.js@4.12.0
4.12.3

Open the chart page →

19,560
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
gjeanmart/safe-ganache-node:latest926264c8f2d1
bn.js@4.12.0
4.12.3

Open the chart page →

16,620
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
bn.js@4.12.0
4.12.3

Open the chart page →

3,118
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
bn.js@4.12.0
4.12.3

Open the chart page →

3,638
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
bn.js@4.12.2
4.12.3

Open the chart page →

1,991
dashysergiotocaliniVerified publisher1.0.01 of 1See more

dashy sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
bn.js@5.2.1
5.2.3

Open the chart page →

3,143
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
bn.js@4.11.8
4.12.3

Open the chart page →

3,696
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
bn.js@4.11.9
4.12.3

Open the chart page →

2,460
sorry-cypresssoftonic1.20.01 of 4See more

sorry-cypress softonic 1.20.0

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
bn.js@4.12.0
4.12.3

Open the chart page →

4,285
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
bn.js@4.12.0
4.12.3

Open the chart page →

4,052
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
bn.js@4.12.0
4.12.3

Open the chart page →

3,881
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
bn.js@4.11.8
4.12.3

Open the chart page →

4,017
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
bn.js@4.12.0
4.12.3

Open the chart page →

20,270
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
bn.js@4.12.0
4.12.3

Open the chart page →

3,118
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
bn.js@5.2.1
5.2.3

Open the chart page →

5,984
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
bn.js@4.12.0
4.12.3

Open the chart page →

5,484
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
bn.js@4.11.9
4.12.3

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
bn.js@4.11.9
4.12.3

Open the chart page →

22,665
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
bn.js@4.11.9
4.12.3

Open the chart page →

6,285
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
bn.js@4.12.0
4.12.3

Open the chart page →

9,381

Container images carrying it

114 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
lissy93/dashy:2.0.51991f7be5ed0
bn.js@5.2.0
5.2.3
1
lsstsqre/squareone:0.4.09ded78e7fe03
bn.js@4.12.0
4.12.3
1
microcks/microcks-postman-runtime:latestcb72e46a1b3c
bn.js@4.11.8
4.12.3
1
misskey/misskey:12.110.1e08b7c478093
bn.js@4.11.8
4.12.3
1
mozilla/sentencecollector:2.0.91da6ff5c4895
bn.js@4.11.8
4.12.3
1
n8nio/n8n:1.86.08b39ed5a2de9
bn.js@5.2.1
5.2.3
1
n8nio/n8n:0.212.0a9195bc499a3
bn.js@4.12.0
4.12.3
1
n8nio/n8n:1.33.1dd171d45102a
bn.js@5.2.1
5.2.3
1
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
bn.js@4.11.9
4.12.3
1
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
bn.js@4.12.0
4.12.3
1
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
bn.js@4.12.0
4.12.3
1
obolnetwork/charon-dkg-sidecar:maine263be0a7440
bn.js@4.12.2
4.12.3
1
ondrejsika/parking:latestb1fd497416c8
bn.js@4.11.8
4.12.3
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
bn.js@4.12.0
4.12.3
1
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
bn.js@4.12.0
4.12.3
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
bn.js@5.2.0
5.2.3
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
bn.js@5.2.1
5.2.3
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
bn.js@4.11.6
4.12.3
1
penpotapp/exporter:2.2.15c835ffd87ab
bn.js@5.2.1
5.2.3
1
phntom/codimd:2.4.31b9aafbb62e6
bn.js@4.12.0
4.12.3
1
polonel/trudesk:1.2.60cf6513f6fe3
bn.js@4.11.8
4.12.3
1
rakii8585/angular-node-webapp:latest026082a515ac
bn.js@4.12.0
4.12.3
1
requarks/wiki:canary-2.5.2438b5865a7386c
bn.js@4.12.0
4.12.3
1
samajh/alprfrontend:latest05ef4fddbb75
bn.js@4.12.0
4.12.3
1
sigp/siren:v3.0.42c219b04758e
bn.js@5.2.1
5.2.3
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
bn.js@4.12.0
4.12.3
1
sqlpad/sqlpad:6.7d3d2f430dffd
bn.js@4.12.0
4.12.3
1
subsquid/hydra-indexer:5.0.0-alpha.37a7f8b9bad7ee
bn.js@5.2.0
5.2.3
1
temporalio/web:1.14.033cfa863d8ce
bn.js@4.11.9
4.12.3
1
testhubio/testhub-frontend:on-preme86c2db53be8
bn.js@4.11.8
4.12.3
1
thelounge/thelounge:4.3.0-alpine0037aa258261
bn.js@4.12.0
4.12.3
1
thelounge/thelounge:4.2.0-alpine639978459c3a
bn.js@4.11.9
4.12.3
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
bn.js@4.12.0
4.12.3
1
ubercadence/web:v3.29.58564a5b44a6d
bn.js@4.11.9
4.12.3
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
bn.js@4.12.0
4.12.3
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
bn.js@5.2.1
5.2.3
1
wazuh/wazuh-dashboard:4.4.11787550d2358
bn.js@4.12.0
4.12.3
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
bn.js@4.12.0
4.12.3
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
bn.js@5.2.1
5.2.3
1
wekanteam/wekan:v4.2268a51f0327df
bn.js@4.11.8
4.12.3
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
bn.js@4.12.0
4.12.3
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
bn.js@4.12.2
4.12.3
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
bn.js@4.12.2
4.12.3
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
bn.js@4.12.2
4.12.3
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
bn.js@4.12.0
4.12.3
1
ghcr.io/data-fair/metrics:0a8d40779eeae
bn.js@4.12.0
4.12.3
1
ghcr.io/data-fair/notify:3c739b74dabb0
bn.js@4.12.1
4.12.3
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
bn.js@4.12.0
4.12.3
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
bn.js@4.12.1
4.12.3
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
bn.js@4.12.2
4.12.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.