StackRadar

CVE-2026-35515

Medium

Advisory

Published 6 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
35
of 17,781 indexed, latest versions
Container images
35
deployed by those charts
Fix available
1 of 1
affected package

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 35 images.

Affected packageAffected versionsFixed inImages
@nestjs/corenpm7.6.15, 8.0.0, 8.0.6, 8.3.1+22 more11.1.1835
OSV records
GHSA-36xv-jgw5-4q75

Charts affected

35 by stars
ChartLatestAffected imagesRadar Score
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
@nestjs/core@9.4.0
11.1.18

Open the chart page →

2,828
redisinsight-secureredisinsight-secureVerified publisher1.0.21 of 1See more

redisinsight-secure redisinsight-secure 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
redis/redisinsight:2.68019fcf774631
@nestjs/core@10.4.5
11.1.18

Open the chart page →

1,721
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
@nestjs/core@10.2.7
11.1.18

Open the chart page →

3,451
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
@nestjs/core@10.4.22
11.1.18

Open the chart page →

4,016
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
@nestjs/core@11.1.17
11.1.18
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
@nestjs/core@11.1.17
11.1.18

Open the chart page →

31,510
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
@nestjs/core@8.4.4
11.1.18

Open the chart page →

15,653
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
@nestjs/core@11.1.8
11.1.18

Open the chart page →

15,712
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
@nestjs/core@9.2.1
11.1.18

Open the chart page →

2,473
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
@nestjs/core@10.4.19
11.1.18

Open the chart page →

2,083
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
@nestjs/core@9.2.0
11.1.18

Open the chart page →

4,455
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
@nestjs/core@11.0.20
11.1.18
sysnet4admin/colosseum-prm:log5802bfcd7fed
@nestjs/core@11.0.20
11.1.18

Open the chart page →

26,996
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
@nestjs/core@8.0.6
11.1.18

Open the chart page →

3,769
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
@nestjs/core@10.2.7
11.1.18

Open the chart page →

3,451
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
@nestjs/core@10.4.4
11.1.18

Open the chart page →

3,614
crypto-watchdoghuseyinnurbaki0.1.01 of 1See more

crypto-watchdog huseyinnurbaki 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
hhaluk/crypto-watchdog:0.4.0a6555953d941
@nestjs/core@7.6.15
11.1.18

Open the chart page →

2,656
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
@nestjs/core@10.4.22
11.1.18

Open the chart page →

781
redisinsightklicktippVerified publisher0.5.01 of 1See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
redis/redisinsight:3.2.055542a762210
@nestjs/core@11.0.20
11.1.18

Open the chart page →

1,290
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
@nestjs/core@10.2.5
11.1.18

Open the chart page →

9,098
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
@nestjs/core@8.3.1
11.1.18

Open the chart page →

4,230
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@nestjs/core@8.0.0
11.1.18

Open the chart page →

5,410
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
@nestjs/core@10.0.2
11.1.18

Open the chart page →

2,178
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
kubebb/bff-server:v0.2.0-202312040fbb732379bc
@nestjs/core@9.0.11
11.1.18

Open the chart page →

13,819
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
@nestjs/core@10.3.0
11.1.18

Open the chart page →

9,774
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
neoskop/papergirl:3.2.67f52b5949f03
@nestjs/core@10.3.1
11.1.18

Open the chart page →

6,982
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
@nestjs/core@10.4.7
11.1.18

Open the chart page →

4,219
mishtip2p-avs0.1.01 of 2See more

mishti p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
mishtinetwork/operator:latestbb3fe67a5f7c
@nestjs/core@8.4.7
11.1.18

Open the chart page →

3,999
ungatep2p-avs0.1.01 of 3See more

ungate p2p-avs 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
@nestjs/core@8.4.7
11.1.18

Open the chart page →

27,373
redisinsightredisinsight-helmVerified publisher0.1.11 of 1See more

redisinsight redisinsight-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
redis/redisinsight:2.46699d341bd329
@nestjs/core@9.4.0
11.1.18

Open the chart page →

1,884
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
@nestjs/core@10.3.0
11.1.18

Open the chart page →

6,282
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
@nestjs/core@10.3.10
11.1.18

Open the chart page →

19,560
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@nestjs/core@11.1.3
11.1.18

Open the chart page →

1,313
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
@nestjs/core@9.4.0
11.1.18

Open the chart page →

39,090
redis-vector-dbtest-opea1.0.01 of 1See more

redis-vector-db test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
@nestjs/core@9.4.0
11.1.18

Open the chart page →

5,604
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
@nestjs/core@10.3.0
11.1.18

Open the chart page →

17,323
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-35515.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
@nestjs/core@10.4.18
11.1.18

Open the chart page →

5,984

Container images carrying it

35 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
hoppscotch/hoppscotch:2024.8.2f1da831950b7
@nestjs/core@10.2.7
11.1.18
2
redis/redis-stack:7.2.0-v91c5f43fddcdd
@nestjs/core@9.4.0
11.1.18
2
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
@nestjs/core@9.2.0
11.1.18
1
cryptexlabs/authf:0.12.11189c07411d7c
@nestjs/core@8.0.6
11.1.18
1
heywood8/redisinsight:2.28.00bc9ab313d37
@nestjs/core@9.4.0
11.1.18
1
hhaluk/crypto-watchdog:0.4.0a6555953d941
@nestjs/core@7.6.15
11.1.18
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
@nestjs/core@10.4.4
11.1.18
1
kubebb/bff-server:v0.2.0-202312040fbb732379bc
@nestjs/core@9.0.11
11.1.18
1
kubebb/component-store:latestfd8ecbd73213
@nestjs/core@10.0.2
11.1.18
1
lukasreining/open-api-schema-collector:0.1.050e021c42e33
@nestjs/core@9.2.1
11.1.18
1
mishtinetwork/operator:latestbb3fe67a5f7c
@nestjs/core@8.4.7
11.1.18
1
neoskop/papergirl:3.2.67f52b5949f03
@nestjs/core@10.3.1
11.1.18
1
nocodb/nocodb:latest4b760f0d2547
@nestjs/core@10.4.22
11.1.18
1
nocodb/nocodb:0.258.06779a4ddedf2
@nestjs/core@10.4.7
11.1.18
1
nocodb/nocodb:0.301.5d9516f0bf546
@nestjs/core@10.4.22
11.1.18
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
@nestjs/core@8.3.1
11.1.18
1
redis/redisinsight:2.68019fcf774631
@nestjs/core@10.4.5
11.1.18
1
redis/redisinsight:3.2.055542a762210
@nestjs/core@11.0.20
11.1.18
1
redis/redisinsight:2.46699d341bd329
@nestjs/core@9.4.0
11.1.18
1
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
@nestjs/core@10.3.10
11.1.18
1
sigp/siren:v3.0.42c219b04758e
@nestjs/core@10.4.18
11.1.18
1
sysnet4admin/colosseum-cms:loge74b43c7f492
@nestjs/core@11.0.20
11.1.18
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
@nestjs/core@11.0.20
11.1.18
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@nestjs/core@8.0.0
11.1.18
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
@nestjs/core@10.2.5
11.1.18
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
@nestjs/core@8.4.7
11.1.18
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
@nestjs/core@10.4.19
11.1.18
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
@nestjs/core@11.1.8
11.1.18
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
@nestjs/core@10.3.0
11.1.18
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
@nestjs/core@8.4.4
11.1.18
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
@nestjs/core@10.3.0
11.1.18
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@nestjs/core@11.1.3
11.1.18
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
@nestjs/core@10.3.0
11.1.18
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
@nestjs/core@11.1.17
11.1.18
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
@nestjs/core@11.1.17
11.1.18
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.