StackRadar

CVE-2026-2739

Medium

Advisory

Published 20 Feb 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 17,781 indexed, latest versions
Container images
114
deployed by those charts
Fix available
1 of 1
affected package

bn.js affected by an infinite loop

Carried by container images the latest versions of 127 of 17,781 indexed charts deploy, on 114 images.

Affected packageAffected versionsFixed inImages
bn.jsnpm4.11.6, 4.11.8, 4.11.9, 4.12.0+6 more4.12.3, 5.2.3114
OSV records
GHSA-378v-28hj-76wf

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
bn.js@5.2.1
5.2.3

Open the chart page →

11,384
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
bn.js@4.12.0
4.12.3

Open the chart page →

9,203
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
bn.js@4.12.0
4.12.3

Open the chart page →

8,364
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
bn.js@4.12.2
4.12.3

Open the chart page →

3,004
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
bn.js@5.2.1
5.2.3

Open the chart page →

5,639
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
bn.js@4.12.0
4.12.3

Open the chart page →

4,285
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
bn.js@4.11.8
4.12.3

Open the chart page →

10,732
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
bn.js@4.12.0
4.12.3

Open the chart page →

14,238
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
bn.js@5.2.1
5.2.3

Open the chart page →

6,168
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
bn.js@4.11.8
4.12.3

Open the chart page →

5,251
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
bn.js@4.12.0
4.12.3

Open the chart page →

5,946
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
bn.js@5.2.0
5.2.3

Open the chart page →

10,530
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
bn.js@4.12.0
4.12.3

Open the chart page →

2,654
open5gsopen5gsVerified publisher2.3.41 of 5See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
bn.js@4.11.8
4.12.3

Open the chart page →

9,261
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
bn.js@4.12.0
4.12.3

Open the chart page →

7,450
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
bn.js@5.2.1
5.2.3

Open the chart page →

17,404
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
bn.js@4.12.0
4.12.3

Open the chart page →

2,521
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
bn.js@4.12.0
4.12.3

Open the chart page →

7,579
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
bn.js@4.12.0
4.12.3

Open the chart page →

3,476
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
bn.js@4.11.8
4.12.3

Open the chart page →

6,868
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
bn.js@4.12.0
4.12.3

Open the chart page →

7,776
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
bn.js@4.12.0
4.12.3

Open the chart page →

2,702
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
bn.js@4.12.0
4.12.3

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
bn.js@4.12.0
4.12.3

Open the chart page →

77,687
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
bn.js@4.12.2
4.12.3

Open the chart page →

1,991
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
bn.js@5.2.1
5.2.3

Open the chart page →

1,843
data-fairdata354-helmVerified publisher1.1.23 of 12See more

data-fair data354-helm 1.1.2

3 of the 12 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/data-fair/metrics:0a8d40779eeae
bn.js@4.12.0
4.12.3
ghcr.io/data-fair/notify:3c739b74dabb0
bn.js@4.12.1
4.12.3
ghcr.io/data-fair/simple-directory:438a4f32fad82
bn.js@4.12.0
4.12.3

Open the chart page →

38,346
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
bn.js@4.12.0
4.12.3

Open the chart page →

5,056
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
bn.js@5.2.0
5.2.3

Open the chart page →

3,925
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
bn.js@4.12.2
4.12.3

Open the chart page →

31,510
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
bn.js@5.1.3
5.2.3

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
bn.js@4.12.0
4.12.3

Open the chart page →

7,801
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
bn.js@5.2.1
5.2.3

Open the chart page →

3,143
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
bn.js@5.2.0
5.2.3

Open the chart page →

5,940
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
bn.js@4.11.8
4.12.3

Open the chart page →

5,300
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
bn.js@4.12.1
4.12.3

Open the chart page →

2,823
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
bn.js@4.11.8
4.12.3

Open the chart page →

7,517
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
bn.js@4.11.8
4.12.3

Open the chart page →

25,443
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
bn.js@4.12.0
4.12.3

Open the chart page →

3,437
angular-chartangular-application0.1.01 of 1See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ibarreche/cloud-front-ci:latestc8970ac1c8dc
bn.js@4.12.0
4.12.3

Open the chart page →

3,237
angular-node-chartangular-webapp2.0.01 of 1See more

angular-node-chart angular-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
rakii8585/angular-node-webapp:latest026082a515ac
bn.js@4.12.0
4.12.3

Open the chart page →

2,616
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
bn.js@4.12.0
4.12.3

Open the chart page →

77,706
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
bn.js@4.12.0
4.12.3

Open the chart page →

77,706
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
bn.js@4.12.2
4.12.3

Open the chart page →

2,136
overseerrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

overseerr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
linuxserver/overseerr:1.35.06108ed066d4a
bn.js@4.12.0
4.12.3

Open the chart page →

3,071
dv-podcharonOfficialVerified publisher0.19.11 of 5See more

dv-pod charon 0.19.1

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
obolnetwork/charon-dkg-sidecar:maine263be0a7440
bn.js@4.12.2
4.12.3

Open the chart page →

7,405
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
bn.js@4.11.8
4.12.3

Open the chart page →

29,901
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
bn.js@4.11.8
4.12.3

Open the chart page →

25,456
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
bn.js@4.12.0
4.12.3

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
bn.js@4.12.0
4.12.3

Open the chart page →

5,141

Container images carrying it

114 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
bn.js@4.12.0
4.12.3
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
bn.js@4.12.0
4.12.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
bn.js@4.12.0
4.12.3
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
bn.js@4.12.0
4.12.3
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
bn.js@5.1.3
5.2.3
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
bn.js@4.12.0
4.12.3
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
bn.js@4.12.2
4.12.3
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
bn.js@4.11.6
4.12.3
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
bn.js@4.12.0
4.12.3
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
bn.js@4.11.8
4.12.3
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
bn.js@4.11.9
4.12.3
1
quay.io/wekan/wekan:v5.65cb17600883a3
bn.js@4.12.0
4.12.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
bn.js@4.12.2
4.12.3
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
bn.js@4.11.8
4.12.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.