StackRadarChart IndexLive demo

CVE-2026-39407

Medium

Advisory

Published 8 Apr 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 8; of 17,781 indexed, latest versions
Container images: 9; deployed by those charts
Fix available: 1 of 1; affected package

Hono: Middleware bypass via repeated slashes in serveStatic

Carried by container images the latest versions of 8 of 17,781 indexed charts deploy, on 9 images.

Affected package	Affected versions	Fixed in	Images
hononpm	4.6.12, 4.7.11, 4.10.4, 4.11.4+5 more	4.12.12	9

OSV records: GHSA-wmmm-f939-6g9c

Charts affected

8 by stars

Chart

Latest

Affected images

Radar Score

cosmocosmo-platform

1 of 10 See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/cdn :0.14.1	d86fcf169f15	hono@4.6.12	4.12.12

Open the chart page →

28,839

nocodbzekker6

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	hono@4.12.8	4.12.12

Open the chart page →

4,016

directusdirectus-io

1 of 3 See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
directus/directus :12.0.2	9c8470ea465c	hono@4.12.4	4.12.12

Open the chart page →

7,473

karakeepself-hosters-by-night

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	hono@4.7.11	4.12.12

Open the chart page →

5,213

adeptia-automate-mcpadeptia-automate-mcp

2 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	hono@4.12.5	4.12.12
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	hono@4.12.7	4.12.12

Open the chart page →

3,600

umamikubernetes-homelab-helm-charts

1 of 3 See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	hono@4.11.4	4.12.12

Open the chart page →

2,596

rsshubsb-helm-charts

1 of 1 See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
diygod/rsshub :2025-11-09	7a6312cac0d5	hono@4.10.4	4.12.12

Open the chart page →

4,684

unleash-enterpriseunleash

1 of 1 See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-39407.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	hono@4.12.3	4.12.12

Open the chart page →

2,028

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	hono@4.12.5	4.12.12	1
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	hono@4.12.7	4.12.12	1
directus/directus :12.0.2	9c8470ea465c	hono@4.12.4	4.12.12	1
diygod/rsshub :2025-11-09	7a6312cac0d5	hono@4.10.4	4.12.12	1
nocodb/nocodb :0.301.5	d9516f0bf546	hono@4.12.8	4.12.12	1
unleashorg/unleash-enterprise :7.5.0	245aeba40053	hono@4.12.3	4.12.12	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	hono@4.7.11	4.12.12	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	hono@4.11.4	4.12.12	1
ghcr.io/wundergraph/cosmo/cdn :0.14.1	d86fcf169f15	hono@4.6.12	4.12.12	1