StackRadar

CVE-2026-34043

Medium

Advisory

Published 27 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
155
of 17,781 indexed, latest versions
Container images
160
deployed by those charts
Fix available
1 of 2
affected packages

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

Carried by container images the latest versions of 155 of 17,781 indexed charts deploy, on 160 images.

Affected packageAffected versionsFixed inImages
serialize-javascriptnpm5.0.1, 6.0.0, 6.0.1, 6.0.2+2 more7.0.5160
node-serialize-javascriptdeb6.0.1-1no fix listed1
OSV records
GHSA-qj8w-gfj5-8c6vUBUNTU-CVE-2026-34043

Charts affected

155 by stars
ChartLatestAffected imagesRadar Score
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
serialize-javascript@6.0.2
7.0.5

Open the chart page →

2,759
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
node-serialize-javascript@6.0.1-1
serialize-javascript@6.0.1
no fix listed
7.0.5

Open the chart page →

13,220
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
serialize-javascript@6.0.1
7.0.5

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
serialize-javascript@6.0.1
7.0.5

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
serialize-javascript@6.0.1
7.0.5

Open the chart page →

5,141
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
serialize-javascript@5.0.1
7.0.5

Open the chart page →

12,907
containers-security-chartscontainers-security0.1.02 of 7See more

containers-security-charts containers-security 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
coldatom/containers-security-api:latesteae9e82da080
serialize-javascript@6.0.1
7.0.5
coldatom/containers-security-front:latest7c2fbbb41bcf
serialize-javascript@6.0.1
7.0.5

Open the chart page →

9,146
cortezacorteza1.0.121 of 3See more

corteza corteza 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
serialize-javascript@6.0.2
7.0.5

Open the chart page →

8,368
myawesomeappcuriousgeekshelmfirstapp0.1.21 of 1See more

myawesomeapp curiousgeekshelmfirstapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
srini78/nodejswebappeks:latest5d1cbdc6833a
serialize-javascript@6.0.0
7.0.5

Open the chart page →

1,267
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
serialize-javascript@6.0.2
7.0.5

Open the chart page →

19,224
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
serialize-javascript@6.0.2
7.0.5

Open the chart page →

4,551
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
serialize-javascript@6.0.2
7.0.5

Open the chart page →

2,862
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
serialize-javascript@5.0.1
7.0.5

Open the chart page →

3,744
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,266
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
serialize-javascript@5.0.1
7.0.5

Open the chart page →

3,260
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
serialize-javascript@6.0.0
7.0.5

Open the chart page →

4,756
fickyhelmappfickyhelmapp1.1.01 of 1See more

fickyhelmapp fickyhelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
tundeficky/nodejs-app:v1.0.03cf9a9ce54e8
serialize-javascript@6.0.0
7.0.5

Open the chart page →

3,311
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
serialize-javascript@6.0.2
7.0.5

Open the chart page →

1,847
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
serialize-javascript@6.0.1
7.0.5

Open the chart page →

4,650
littlelink-servergeek-cookbookVerified publisher1.4.21 of 1See more

littlelink-server geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
serialize-javascript@6.0.2
7.0.5

Open the chart page →

819
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
serialize-javascript@5.0.1
7.0.5

Open the chart page →

4,043
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
serialize-javascript@6.0.0
7.0.5

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
serialize-javascript@6.0.0
7.0.5

Open the chart page →

24,319
littlelink-serverh2mVerified publisher1.0.11 of 1See more

littlelink-server h2m 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
serialize-javascript@6.0.2
7.0.5

Open the chart page →

819
h2ph2pVerified publisher1.0.11 of 1See more

h2p h2p 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
dacinfomotion/h2p:latest68fa393b472c
serialize-javascript@6.0.0
7.0.5

Open the chart page →

1,713
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
serialize-javascript@6.0.2
7.0.5

Open the chart page →

3,451
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
serialize-javascript@6.0.2
7.0.5

Open the chart page →

5,769
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
serialize-javascript@6.0.0
7.0.5

Open the chart page →

18,813
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
serialize-javascript@6.0.2
7.0.5

Open the chart page →

6,012
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
serialize-javascript@6.0.2
7.0.5

Open the chart page →

3,614
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
serialize-javascript@6.0.1
7.0.5

Open the chart page →

3,407
iframelyiframelyVerified publisher2.3.51 of 1See more

iframely iframely 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
serialize-javascript@6.0.2
7.0.5

Open the chart page →

3,154
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
serialize-javascript@6.0.2
7.0.5

Open the chart page →

11,812
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
serialize-javascript@6.0.0
7.0.5

Open the chart page →

4,944
keyoxide-webittrident-oss0.2.31 of 1See more

keyoxide-web ittrident-oss 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
keyoxide/keyoxide:stable96f27a71269d
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,363
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
serialize-javascript@6.0.2
7.0.5

Open the chart page →

5,826
annotation-tooljtektVerified publisher0.1.51 of 2See more

annotation-tool jtekt 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
moreillon/api-proxy:a3e8b41e9e578c9653b6
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,315
image-storage-servicejtektVerified publisher0.4.31 of 4See more

image-storage-service jtekt 0.4.3

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
serialize-javascript@6.0.0
7.0.5

Open the chart page →

22,589
polygonal-annotation-tooljtektVerified publisher0.1.51 of 2See more

polygonal-annotation-tool jtekt 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
moreillon/api-proxy:a3e8b41e9e578c9653b6
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,231
shinsei-managerjtektVerified publisher0.2.04 of 8See more

shinsei-manager jtekt 0.2.0

4 of the 8 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
moreillon/api-proxy:latestd7d4a5463525
serialize-javascript@6.0.0
7.0.5
moreillon/group-manager:latest3caa8f710ee0
serialize-javascript@6.0.0
7.0.5
moreillon/user-manager:v5.0.2e1c9bfab5c16
serialize-javascript@6.0.0
7.0.5
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
serialize-javascript@6.0.0
7.0.5

Open the chart page →

63,461
time-series-storagejtektVerified publisher0.1.101 of 2See more

time-series-storage jtekt 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
serialize-javascript@6.0.0
7.0.5

Open the chart page →

16,600
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
serialize-javascript@6.0.0
7.0.5

Open the chart page →

9,783
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
serialize-javascript@6.0.1
7.0.5

Open the chart page →

9,098
kubevious-agentkubevious1.0.41 of 1See more

kubevious-agent kubevious 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
kubevious/parser:1.0.151acf1a1f0b47
serialize-javascript@5.0.1
7.0.5

Open the chart page →

1,927
workload-operatorkubevious0.0.31 of 1See more

workload-operator kubevious 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
kubevious/workload-operator:1.0.20b0f4c507eb6
serialize-javascript@6.0.0
7.0.5

Open the chart page →

2,008
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
serialize-javascript@6.0.2
7.0.5

Open the chart page →

9,774
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
serialize-javascript@6.0.2
7.0.5

Open the chart page →

8,303
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
serialize-javascript@5.0.1
7.0.5

Open the chart page →

5,940
littlelink-servermhamzahkhanVerified publisher1.0.01 of 1See more

littlelink-server mhamzahkhan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
serialize-javascript@6.0.2
7.0.5

Open the chart page →

887
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-34043.

Container imageDigestPackageFixed in
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
serialize-javascript@5.0.1
7.0.5

Open the chart page →

43,341

Container images carrying it

160 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
serialize-javascript@6.0.2
7.0.5
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
serialize-javascript@6.0.2
7.0.5
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
serialize-javascript@6.0.0
7.0.5
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
serialize-javascript@6.0.0
7.0.5
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
serialize-javascript@6.0.0
7.0.5
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
serialize-javascript@6.0.2
7.0.5
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
serialize-javascript@5.0.1
7.0.5
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
serialize-javascript@6.0.2
7.0.5
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
serialize-javascript@6.0.2
7.0.5
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
serialize-javascript@6.0.2
7.0.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.