StackRadar

CVE-2026-2739

Medium

Advisory

Published 20 Feb 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 17,781 indexed, latest versions
Container images
114
deployed by those charts
Fix available
1 of 1
affected package

bn.js affected by an infinite loop

Carried by container images the latest versions of 127 of 17,781 indexed charts deploy, on 114 images.

Affected packageAffected versionsFixed inImages
bn.jsnpm4.11.6, 4.11.8, 4.11.9, 4.12.0+6 more4.12.3, 5.2.3114
OSV records
GHSA-378v-28hj-76wf

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
bn.js@4.12.0
4.12.3

Open the chart page →

5,141
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
bn.js@4.11.9
4.12.3

Open the chart page →

12,907
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
bn.js@4.12.0
4.12.3

Open the chart page →

3,769
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
bn.js@4.12.0
4.12.3

Open the chart page →

13,852
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
bn.js@4.11.8
4.12.3

Open the chart page →

11,174
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
bn.js@4.12.0
4.12.3

Open the chart page →

3,744
blobscanethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethpandaops/blobscan:latest7a9ab6370657
bn.js@5.2.1
5.2.3

Open the chart page →

1,329
blobscan-indexerethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan-indexer ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethpandaops/blobscan-indexer:latestc58eb9ffe446
bn.js@4.12.0
4.12.3

Open the chart page →

2,114
testnet-faucetethereum-helm-chartsVerified publisher0.1.31 of 1See more

testnet-faucet ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
parithoshj/testnet-faucet:9859e0dcdca426fea6d
bn.js@4.11.6
4.12.3

Open the chart page →

3,005
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
bn.js@5.2.1
5.2.3

Open the chart page →

2,266
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
bn.js@5.2.0
5.2.3

Open the chart page →

3,260
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
bn.js@5.2.1
5.2.3

Open the chart page →

4,756
onboarding-faucetethersphereVerified publisher0.2.01 of 1See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethersphere/onboarding-faucet:0.3.0513154aab230
bn.js@4.12.0
4.12.3

Open the chart page →

3,320
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
bn.js@4.12.0
4.12.3

Open the chart page →

64,489
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
bn.js@4.11.8
4.12.3

Open the chart page →

5,941
galoy-paygaloymoney0.11.481 of 2See more

galoy-pay galoymoney 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
bn.js@5.2.1
5.2.3

Open the chart page →

2,528
rtlgaloymoney0.4.31 of 2See more

rtl galoymoney 0.4.3

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.13.3e2195188a451
bn.js@4.12.0
4.12.3

Open the chart page →

2,090
galoy-paygaloymoney20.11.481 of 2See more

galoy-pay galoymoney2 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
bn.js@5.2.1
5.2.3

Open the chart page →

2,528
rtlgaloymoney20.4.31 of 2See more

rtl galoymoney2 0.4.3

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.13.3e2195188a451
bn.js@4.12.0
4.12.3

Open the chart page →

2,090
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
bn.js@4.11.9
4.12.3

Open the chart page →

4,043
theloungegeek-cookbookVerified publisher3.4.21 of 1See more

thelounge geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
thelounge/thelounge:4.2.0-alpine639978459c3a
bn.js@4.11.9
4.12.3

Open the chart page →

2,689
theloungehalkeye4.3.11 of 1See more

thelounge halkeye 4.3.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
thelounge/thelounge:4.3.0-alpine0037aa258261
bn.js@4.12.0
4.12.3

Open the chart page →

1,938
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
bn.js@4.12.0
4.12.3

Open the chart page →

4,253
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
bn.js@4.11.8
4.12.3

Open the chart page →

32,915
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
bn.js@5.2.0
5.2.3

Open the chart page →

4,944
interbtc-hydrainterlay0.1.152 of 4See more

interbtc-hydra interlay 0.1.15

2 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
bn.js@5.2.0
5.2.3
subsquid/hydra-indexer:5.0.0-alpha.37a7f8b9bad7ee
bn.js@5.2.0
5.2.3

Open the chart page →

6,831
interlay-firesquidinterlay0.1.111 of 4See more

interlay-firesquid interlay 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:0.10.55b2c414307b9
bn.js@5.2.1
5.2.3

Open the chart page →

4,667
keyoxide-webittrident-oss0.2.31 of 1See more

keyoxide-web ittrident-oss 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
keyoxide/keyoxide:stable96f27a71269d
bn.js@4.12.0
4.12.3

Open the chart page →

2,363
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
bn.js@5.2.1
5.2.3

Open the chart page →

5,826
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
bn.js@5.2.0
5.2.3

Open the chart page →

6,454
zwave-js-uik8sonlabVerified publisher0.7.121 of 1See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
zwavejs/zwave-js-ui:11.22.314d018bb689e
bn.js@4.12.2
4.12.3

Open the chart page →

973
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
bn.js@4.12.0
4.12.3

Open the chart page →

3,397
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
bn.js@4.12.0
4.12.3

Open the chart page →

5,410
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
bn.js@4.12.2
4.12.3

Open the chart page →

2,548
penpotkubitodevVerified publisher1.2.11 of 5See more

penpot kubitodev 1.2.1

1 of the 5 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
penpotapp/exporter:2.2.15c835ffd87ab
bn.js@5.2.1
5.2.3

Open the chart page →

16,877
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
bn.js@4.12.1
4.12.3

Open the chart page →

3,555
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
bn.js@4.11.8
4.12.3

Open the chart page →

7,929
squareonelsst-sqre0.4.11 of 1See more

squareone lsst-sqre 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
lsstsqre/squareone:0.4.09ded78e7fe03
bn.js@4.12.0
4.12.3

Open the chart page →

2,247
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
bn.js@5.1.1
5.2.3

Open the chart page →

3,651
kubevismario-fVerified publisher2.0.11 of 1See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
bn.js@4.12.0
4.12.3

Open the chart page →

5,287
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
bn.js@5.2.0
5.2.3

Open the chart page →

5,940
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
bn.js@4.12.0
4.12.3

Open the chart page →

12,108
mojaloopmojaloop14.0.01 of 6See more

mojaloop mojaloop 14.0.0

1 of the 6 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
bn.js@4.12.0
4.12.3

Open the chart page →

19,226
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
bn.js@4.11.9
4.12.3

Open the chart page →

6,438
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
bn.js@4.11.8
4.12.3

Open the chart page →

6,684
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
bn.js@4.12.0
4.12.3

Open the chart page →

6,608
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
bn.js@4.12.0
4.12.3

Open the chart page →

3,128
dashynas-helm-chartsVerified publisher1.0.41 of 1See more

dashy nas-helm-charts 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
lissy93/dashy:2.0.51991f7be5ed0
bn.js@5.2.0
5.2.3

Open the chart page →

3,269
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
bn.js@4.12.2
4.12.3

Open the chart page →

2,383
indexer-toolsnodeifyVerified publisher2.1.11 of 1See more

indexer-tools nodeify 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-2739.

Container imageDigestPackageFixed in
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
bn.js@4.11.6
4.12.3

Open the chart page →

2,919

Container images carrying it

114 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
bn.js@4.12.0
4.12.3
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
bn.js@4.12.0
4.12.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
bn.js@4.12.0
4.12.3
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
bn.js@4.12.0
4.12.3
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
bn.js@5.1.3
5.2.3
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
bn.js@4.12.0
4.12.3
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
bn.js@4.12.2
4.12.3
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
bn.js@4.11.6
4.12.3
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
bn.js@4.12.0
4.12.3
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
bn.js@4.11.8
4.12.3
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
bn.js@4.11.9
4.12.3
1
quay.io/wekan/wekan:v5.65cb17600883a3
bn.js@4.12.0
4.12.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
bn.js@4.12.2
4.12.3
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
bn.js@4.11.8
4.12.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.