StackRadar

CVE-2026-3304

High

Advisory

Published 1 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
108
of 17,781 indexed, latest versions
Container images
108
deployed by those charts
Fix available
1 of 1
affected package

Multer vulnerable to Denial of Service via incomplete cleanup

Carried by container images the latest versions of 108 of 17,781 indexed charts deploy, on 108 images.

Affected packageAffected versionsFixed inImages
multernpm0.1.8, 1.3.0, 1.4.1, 1.4.2+7 more2.1.0108
OSV records
GHSA-xf7r-hgr6-v32p

Charts affected

108 by stars
ChartLatestAffected imagesRadar Score
api-mapperglenndehaanVerified publisher1.2.01 of 1See more

api-mapper glenndehaan 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
glenndehaan/api-mapper:latest6ff6310683bf
multer@1.4.5-lts.1
2.1.0

Open the chart page →

1,158
contentbridgeglenndehaanVerified publisher1.1.01 of 1See more

contentbridge glenndehaan 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
glenndehaan/contentbridge:latest99b9e4f73848
multer@1.4.5-lts.1
2.1.0

Open the chart page →

1,000
Governify-Bluejaygovernify0.1.03 of 12See more

Governify-Bluejay governify 0.1.0

3 of the 12 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
governify/director:v1.4.0608c6940bb98
multer@1.4.3
2.1.0
governify/registry:v3.4.0d3f37f4f8168
multer@1.4.2
2.1.0
governify/reporter:v2.2.038595913458f
multer@1.4.2
2.1.0

Open the chart page →

22,512
Governify-Falcongovernify0.1.04 of 10See more

Governify-Falcon governify 0.1.0

4 of the 10 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
governify/collector-dynamic:v1.3.06d3d1a5b46a9
multer@1.4.2
2.1.0
governify/director:v1.4.0608c6940bb98
multer@1.4.3
2.1.0
governify/registry:v3.4.0d3f37f4f8168
multer@1.4.2
2.1.0
governify/reporter:v2.2.038595913458f
multer@1.4.2
2.1.0

Open the chart page →

24,319
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
multer@1.4.5-lts.1
2.1.0

Open the chart page →

2,950
home-assistant-matter-hubhelm-chart-roeiVerified publisher3.0.21 of 1See more

home-assistant-matter-hub helm-chart-roei 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
luligu/matterbridge:3.0.28f97884bebc2
multer@1.4.5-lts.2
2.1.0

Open the chart page →

3,806
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
multer@1.4.2
2.1.0
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
multer@0.1.8
2.1.0
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
multer@1.4.2
2.1.0
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
multer@1.4.2
2.1.0

Open the chart page →

89,959
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
multer@1.4.4-lts.1
2.1.0

Open the chart page →

3,451
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
multer@1.4.5-lts.1
2.1.0

Open the chart page →

5,769
bytestashhelmforgeVerified publisher1.0.01 of 1See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
multer@1.4.5-lts.2
2.1.0

Open the chart page →

739
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
multer@1.4.2
2.1.0

Open the chart page →

4,253
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
multer@1.4.4-lts.1
2.1.0

Open the chart page →

3,614
crypto-watchdoghuseyinnurbaki0.1.01 of 1See more

crypto-watchdog huseyinnurbaki 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
hhaluk/crypto-watchdog:0.4.0a6555953d941
multer@1.4.2
2.1.0

Open the chart page →

2,656
ibm-business-automation-insights-devibm-charts3.2.01 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

1 of the 6 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
multer@1.4.1
2.1.0

Open the chart page →

39,349
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
multer@1.4.5-lts.2
2.1.0

Open the chart page →

5,826
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
multer@1.3.0
2.1.0

Open the chart page →

6,454
image-storage-servicejtektVerified publisher0.4.31 of 4See more

image-storage-service jtekt 0.4.3

1 of the 4 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
multer@1.4.5-lts.1
2.1.0

Open the chart page →

22,589
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
multer@1.4.5-lts.1
2.1.0

Open the chart page →

9,783
zwave-js-uik8sonlabVerified publisher0.7.121 of 1See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
zwavejs/zwave-js-ui:11.22.314d018bb689e
multer@2.0.2
2.1.0

Open the chart page →

973
redisinsightklicktippVerified publisher0.5.01 of 1See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redisinsight:3.2.055542a762210
multer@2.0.2
2.1.0

Open the chart page →

1,290
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
multer@1.4.4-lts.1
2.1.0

Open the chart page →

9,098
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
multer@1.4.4
2.1.0

Open the chart page →

4,230
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
multer@1.4.4
2.1.0

Open the chart page →

5,410
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
multer@1.4.4-lts.1
2.1.0

Open the chart page →

2,178
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
kubebb/bff-server:v0.2.0-202312040fbb732379bc
multer@1.4.4-lts.1
2.1.0

Open the chart page →

13,819
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
multer@1.4.5-lts.1
2.1.0

Open the chart page →

2,548
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
multer@1.4.5-lts.1
2.1.0

Open the chart page →

3,555
redisinsightlogic3579Verified publisher3.4.01 of 1See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redisinsight:3.485562d67a912
multer@2.0.2
2.1.0

Open the chart page →

1,490
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
multer@1.4.4-lts.1
2.1.0

Open the chart page →

9,774
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/rodg/nodecg-base:latest31be4bf87070
multer@1.4.5-lts.1
2.1.0

Open the chart page →

7,315
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
multer@1.4.5-lts.1
2.1.0

Open the chart page →

9,668
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
multer@2.0.2
2.1.0

Open the chart page →

4,960
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_server:0.3.31a528c794270
multer@1.4.1
2.1.0

Open the chart page →

109,294
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
neoskop/papergirl:3.2.67f52b5949f03
multer@1.4.4-lts.1
2.1.0

Open the chart page →

6,982
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
multer@1.4.4-lts.1
2.1.0

Open the chart page →

4,219
outscale-s3-exploreroutscale-s3-explorer0.1.41 of 1See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
multer@1.4.5-lts.2
2.1.0

Open the chart page →

1,811
mishtip2p-avs0.1.01 of 2See more

mishti p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
mishtinetwork/operator:latestbb3fe67a5f7c
multer@1.4.4-lts.1
2.1.0

Open the chart page →

3,999
ungatep2p-avs0.1.01 of 3See more

ungate p2p-avs 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
multer@1.4.4-lts.1
2.1.0

Open the chart page →

27,373
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
anamskenneth/recipe_backend:2025-06-079b7d2cd389b7
multer@1.4.5-lts.1
2.1.0

Open the chart page →

3,271
redisinsightredisinsightVerified publisher0.1.01 of 1See more

redisinsight redisinsight 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.1.0

Open the chart page →

1,038
redisinsightredisinsight-helmVerified publisher0.1.11 of 1See more

redisinsight redisinsight-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redisinsight:2.46699d341bd329
multer@1.4.4-lts.1
2.1.0

Open the chart page →

1,884
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
multer@1.4.4-lts.1
2.1.0

Open the chart page →

6,282
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
multer@1.4.4-lts.1
2.1.0

Open the chart page →

19,560
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
multer@1.4.5-lts.1
2.1.0

Open the chart page →

5,582
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
multer@2.0.1
2.1.0

Open the chart page →

1,313
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
multer@1.4.4-lts.1
2.1.0

Open the chart page →

39,090
redis-vector-dbtest-opea1.0.01 of 1See more

redis-vector-db test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
multer@1.4.4-lts.1
2.1.0

Open the chart page →

5,604
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
samajh/alprbackend:latestea742b4372ad
multer@1.4.4
2.1.0

Open the chart page →

20,270
node-redth0ths-helm-charts0.2.11 of 2See more

node-red th0ths-helm-charts 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
th0th/node-red:4.0.3-debiand06fa39f7406
multer@1.4.5-lts.1
2.1.0

Open the chart page →

2,408
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-3304.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.1.0

Open the chart page →

4,661

Container images carrying it

108 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/sct/overseerr:1.35.06197516c9d7b
multer@1.4.5-lts.1
2.1.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
multer@1.4.5-lts.1
2.1.0
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
multer@1.4.5-lts.2
2.1.0
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
multer@1.4.4-lts.1
2.1.0
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
multer@2.0.1
2.1.0
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
multer@1.4.5-lts.1
2.1.0
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
multer@1.4.4-lts.1
2.1.0
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
multer@2.0.2
2.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.