StackRadarChart IndexLive demo

CVE-2026-44289

High

Advisory

Published 12 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 48th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 113; of 17,781 indexed, latest versions
Container images: 110; deployed by those charts
Fix available: 1 of 1; affected package

protobuf.js: Denial of service through unbounded protobuf recursion

Carried by container images the latest versions of 113 of 17,781 indexed charts deploy, on 110 images.

Affected package	Affected versions	Fixed in	Images
protobufjsnpm	5.0.3, 6.8.6, 6.8.8, 6.8.9+18 more	7.5.6, 8.0.2	110

OSV records: GHSA-685m-2w69-288q

Charts affected

113 by stars

Chart

Latest

Affected images

Radar Score

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	protobufjs@7.4.0	7.5.6

Open the chart page →

15,635

speckle-server-branch-testing6speckle

2.25.10-branch.testing6.645-b125c1e

1 of 4 See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	protobufjs@7.4.0	7.5.6

Open the chart page →

11,100

retail-store-sample-checkout-chartstacksimplify

1 of 1 See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	protobufjs@7.5.3	7.5.6

Open the chart page →

1,313

fdi-dotstatsuite-dlmstatcan

1 of 1 See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	protobufjs@6.11.2	7.5.6

Open the chart page →

3,881

pachydermstatcan

1 of 4 See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	protobufjs@5.0.3	7.5.6

Open the chart page →

4,967

1 of 1 See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	protobufjs@6.8.9	7.5.6

Open the chart page →

3,827

csmmth-charts

1 of 3 See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
catalysm/csmm :latest	f003b35f54d9	protobufjs@6.11.2	7.5.6

Open the chart page →

3,576

thingsboardthingsboard

1 of 12 See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
thingsboard/tb-js-executor :3.4.1	13e1eadf8ace	protobufjs@6.11.3	7.5.6

Open the chart page →

25,394

kubernetes-external-secretstrozz

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	protobufjs@6.10.2	7.5.6

Open the chart page →

2,838

evolution-apivcnngr

1 of 5 See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	protobufjs@7.5.4	7.5.6

Open the chart page →

3,746

temporalwenerme

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	protobufjs@6.10.2	7.5.6

Open the chart page →

22,665

kibanawiremind

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	protobufjs@7.2.5	7.5.6

Open the chart page →

6,285

workadventureworkadventure

3 of 9 See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-44289.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	protobufjs@7.2.4	7.5.6
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	protobufjs@7.2.4	7.5.6
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	protobufjs@7.2.4	7.5.6

Open the chart page →

16,083

Container images carrying it

110 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	protobufjs@7.4.0	7.5.6	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	protobufjs@7.2.6	7.5.6	1
ghcr.io/middleware-labs/odigos-odiglet :middleware-test-0.0.1	03c8c835ecee	protobufjs@7.2.2	7.5.6	1
ghcr.io/middleware-labs/vision-odiglet :middleware-test-0.0.3	bce34c98668e	protobufjs@7.2.2	7.5.6	1
ghcr.io/open-telemetry/demo :1.12.0-frontend	8b348f00ca4c	protobufjs@7.3.0	7.5.6	1
ghcr.io/open-telemetry/demo :1.12.0-paymentservice	b0f13eef3abf	protobufjs@7.2.5	7.5.6	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	protobufjs@7.5.3	7.5.6	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	protobufjs@7.2.5	7.5.6	1
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	protobufjs@6.11.3	7.5.6	1
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	protobufjs@6.8.9	7.5.6	1