StackRadar

CVE-2026-34043

Medium

Advisory

Published 27 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
155
of 17,781 indexed, latest versions
Container images
160
deployed by those charts
Fix available
1 of 2
affected packages

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

Carried by container images the latest versions of 155 of 17,781 indexed charts deploy, on 160 images.

Affected packageAffected versionsFixed inImages
serialize-javascriptnpm5.0.1, 6.0.0, 6.0.1, 6.0.2+2 more7.0.5160
node-serialize-javascriptdeb6.0.1-1no fix listed1
OSV records
GHSA-qj8w-gfj5-8c6vUBUNTU-CVE-2026-34043

Charts affected

155 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
serialize-javascript@6.0.2
7.0.5

Open the chart page →

19,391
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
serialize-javascript@6.0.2
7.0.5

Open the chart page →

7,210
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
serialize-javascript@5.0.1
7.0.5

Open the chart page →

9,203
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
serialize-javascript@6.0.2
7.0.5

Open the chart page →

5,352
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
serialize-javascript@6.0.2
7.0.5

Open the chart page →

23,123
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
serialize-javascript@6.0.2
7.0.5

Open the chart page →

5,639
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
serialize-javascript@6.0.0
7.0.5

Open the chart page →

30,326
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
serialize-javascript@5.0.1
7.0.5

Open the chart page →

2,828
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
serialize-javascript@6.0.0
7.0.5

Open the chart page →

5,251
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
serialize-javascript@6.0.1
7.0.5

Open the chart page →

3,795
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
serialize-javascript@5.0.1
7.0.5

Open the chart page →

17,404
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
serialize-javascript@6.0.2
7.0.5

Open the chart page →

28,839
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
serialize-javascript@6.0.2
7.0.5

Open the chart page →

3,451
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
serialize-javascript@5.0.1
7.0.5

Open the chart page →

2,521
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
serialize-javascript@5.0.1
7.0.5

Open the chart page →

7,579
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
serialize-javascript@5.0.1
7.0.5

Open the chart page →

3,476
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
instill/console:0.68.54cd70e2df5c6
serialize-javascript@6.0.2
7.0.5

Open the chart page →

30,816
kubeviouskubevious1.2.24 of 7See more

kubevious kubevious 1.2.2

4 of the 7 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
serialize-javascript@6.0.0
7.0.5
kubevious/collector:1.2.1f58226f9d84e
serialize-javascript@6.0.0
7.0.5
kubevious/guard:1.2.19bf567704de2
serialize-javascript@5.0.1
7.0.5
kubevious/parser:1.2.299ae7a5168c2
serialize-javascript@6.0.0
7.0.5

Open the chart page →

14,204
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
serialize-javascript@6.0.0
7.0.5

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
serialize-javascript@5.0.1
7.0.5

Open the chart page →

7,776
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
serialize-javascript@6.0.2
7.0.5

Open the chart page →

4,016
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
serialize-javascript@6.0.1
7.0.5
ghcr.io/data-fair/metrics:0a8d40779eeae
serialize-javascript@5.0.1
7.0.5
ghcr.io/data-fair/notify:3c739b74dabb0
serialize-javascript@6.0.2
7.0.5
ghcr.io/data-fair/portals:18b621866ceb2
serialize-javascript@6.0.2
7.0.5
ghcr.io/data-fair/processings:15a9216989707
serialize-javascript@6.0.1
7.0.5
ghcr.io/data-fair/simple-directory:438a4f32fad82
serialize-javascript@5.0.1
7.0.5

Open the chart page →

38,346
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
serialize-javascript@5.0.1
7.0.5

Open the chart page →

5,056
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
serialize-javascript@7.0.3
7.0.5

Open the chart page →

7,473
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
serialize-javascript@6.0.1
7.0.5

Open the chart page →

3,925
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
serialize-javascript@5.0.1
7.0.5

Open the chart page →

2,519
jspolicyloftVerified publisher0.2.21 of 1See more

jspolicy loft 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
loftsh/jspolicy:0.2.225deb9bd2683
serialize-javascript@6.0.1
7.0.5

Open the chart page →

2,309
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
serialize-javascript@5.0.1
7.0.5

Open the chart page →

5,940
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
serialize-javascript@6.0.2
7.0.5

Open the chart page →

13,738
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
serialize-javascript@7.0.3
7.0.5

Open the chart page →

31,844
pumejwebapppumejnodejswebapp0.1.01 of 1See more

pumejwebapp pumejnodejswebapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
pumejlab/nodejs-webapp:latestf563eabcb819
serialize-javascript@6.0.0
7.0.5

Open the chart page →

1,164
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
serialize-javascript@6.0.2
7.0.5

Open the chart page →

30,234
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
serialize-javascript@6.0.2
7.0.5

Open the chart page →

5,213
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
serialize-javascript@6.0.2
7.0.5

Open the chart page →

11,532
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
serialize-javascript@6.0.2
7.0.5

Open the chart page →

12,581
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
serialize-javascript@6.0.2
7.0.5

Open the chart page →

10,090
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
serialize-javascript@6.0.0
7.0.5

Open the chart page →

9,783
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
serialize-javascript@6.0.0
7.0.5

Open the chart page →

3,437
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,396
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
serialize-javascript@6.0.1
7.0.5

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
serialize-javascript@6.0.2
7.0.5

Open the chart page →

32,501
nas-appsawesomeVerified publisher2.0.01 of 8See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ltdstudio/terraforming-mars:latest0e76c6f4eac0
serialize-javascript@5.0.1
7.0.5

Open the chart page →

7,152
awesomeblessingappawesomeblessingapp1.1.01 of 1See more

awesomeblessingapp awesomeblessingapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
bnwokoye/nodejswebapp:latest74de7dc7ebfb
serialize-javascript@6.0.0
7.0.5

Open the chart page →

1,267
myhelmappbelihelmapp1.1.01 of 1See more

myhelmapp belihelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
belirta/beli-docker:v1.0.0f65ad0e23b4d
serialize-javascript@6.0.0
7.0.5

Open the chart page →

1,187
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
serialize-javascript@6.0.0
7.0.5

Open the chart page →

4,455
bluerange-mosquittobluerangeOfficialVerified publisher1.0.41 of 1See more

bluerange-mosquitto bluerange 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
bluerange/bluerange-mosquitto:25f1bfbba84832
serialize-javascript@5.0.1
7.0.5

Open the chart page →

1,168
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
serialize-javascript@6.0.2
7.0.5
sysnet4admin/colosseum-prm:log5802bfcd7fed
serialize-javascript@6.0.2
7.0.5

Open the chart page →

26,996
chatgpt-next-webchatgpt-next-web0.1.11 of 1See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
serialize-javascript@6.0.1
7.0.5

Open the chart page →

1,977
countlychristianhuthVerified publisher5.2.12 of 3See more

countly christianhuth 5.2.1

2 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
serialize-javascript@6.0.1
7.0.5
countly/frontend:25.05.42acbc11499b6
serialize-javascript@6.0.1
7.0.5

Open the chart page →

7,295

Container images carrying it

160 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
serialize-javascript@6.0.2
7.0.5
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
serialize-javascript@6.0.2
7.0.5
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
serialize-javascript@6.0.0
7.0.5
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
serialize-javascript@6.0.0
7.0.5
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
serialize-javascript@6.0.0
7.0.5
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
serialize-javascript@6.0.2
7.0.5
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
serialize-javascript@5.0.1
7.0.5
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
serialize-javascript@6.0.2
7.0.5
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
serialize-javascript@6.0.2
7.0.5
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
serialize-javascript@6.0.2
7.0.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.