CVE-2026-44490

Medium

Advisory

Published 29 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.8; base score, highest
EPSS: 0.003; 23rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 303; of 17,781 indexed, latest versions
Container images: 300; deployed by those charts
Fix available: 1 of 1; affected package

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Carried by container images the latest versions of 303 of 17,781 indexed charts deploy, on 300 images.

Affected package	Affected versions	Fixed in	Images
axiosnpm	0.15.3, 0.16.2, 0.18.0, 0.18.1+60 more	0.32.0, 1.16.0	300

OSV records: GHSA-898c-q2cr-xwhg

Charts affected

303 by stars

Chart

Latest

Affected images

Radar Score

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-44490.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	axios@1.8.3	1.16.0

Open the chart page →

6,285

workadventureworkadventure

1.1.0

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-44490.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	axios@1.3.5	1.16.0
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	axios@1.3.5	1.16.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	axios@1.3.5	1.16.0
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	axios@1.3.5	1.16.0

Open the chart page →

16,083

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-44490.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	axios@0.28.1	0.32.0

Open the chart page →

9,381

Container images carrying it

300 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
assistiot/cybersecurity-monitoring_ir-kbn :latest	0570b27bb7c2	axios@0.21.1	0.32.0	1
assistiot/dlt_api :2.1.0	c8a170683be7	axios@1.6.5	1.16.0	1
assistiot/fl_orchestrator :api-latest	7473d77448e1	axios@0.19.2	0.32.0	1
assistiot/monitoring_notifying :2.0.0	68324d0fa5bb	axios@1.6.5	1.16.0	1
assistiot/multi-link_client :latest	cf048365d042	axios@1.3.6	1.16.0	1
assistiot/open_api_frontend :1.0.1	f11d82defc70	axios@0.26.1	0.32.0	1
assistiot/smart-orchestrator_cluster :latest	4f41e1defe99	axios@0.27.2	0.32.0	1
assistiot/smart-orchestrator_enabler :latest	89f37e88c871	axios@0.27.2	0.32.0	1
assistiot/smart-orchestrator_repository :latest	a8b8dbed04a4	axios@0.27.2	0.32.0	1
automatischio/automatisch :0.15.0	3bace7a12d5f	axios@1.9.0	1.16.0	1
baserow/baserow :1.30.1	df0c42eb67e8	axios@1.7.7	1.16.0	1
bicarus/mx-api-service :1.0.2-hf1	dab88659ae3b	axios@0.21.4	0.32.0	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	axios@0.21.3	0.32.0	1
budibase/apps :3.41.3	44fe6feab985	axios@1.15.2	1.16.0	1
carbonetes/carbonetes-analyzer :1.0.3	1b9b93c9a37f	axios@0.21.4	0.32.0	1
catalysm/csmm :latest	f003b35f54d9	axios@0.21.4	0.32.0	1
ccjacobs14/amazon :5	9a9b14a6f09e	axios@0.21.4	0.32.0	1
chainsafe/lodestar :latest	5593f6e97912	axios@1.13.3	1.16.0	1
chainsafe/lodestar :v1.27.0	7b9fe4aa8073	axios@1.7.4	1.16.0	1
codetogether/codetogether :latest	4348c8a38752	axios@0.28.0	0.32.0	1
coldatom/containers-security-front :latest	7c2fbbb41bcf	axios@1.3.2	1.16.0	1
cortezaproject/corteza-server-corredor :2024.9.4	4ea78dfe5364	axios@1.8.3	1.16.0	1
countly/api :25.05.4	f4cc7447c4f5	axios@1.6.5	1.16.0	1
countly/countly-server :25.05.4	e3c238248f99	axios@1.6.5	1.16.0	1
countly/frontend :25.05.4	2acbc11499b6	axios@1.6.5	1.16.0	1
cryptexlabs/authf :0.12.11	189c07411d7c	axios@1.7.7	1.16.0	1
defactops/defactops-backend :1.0.23	07b663c0092a	axios@1.2.2	1.16.0	1
directus/directus :11.1.0	e3c8bb975350	axios@1.7.3	1.16.0	1
documenso/documenso :v1.8.1	7f16a9449f18	axios@1.6.2	1.16.0	1
eclipseaerios/benchmarking-tool :1.0.0	a4b4c2e7fe62	axios@1.7.7	1.16.0	1
eclipseaerios/self-orchestrator :1.2.0	8b123bec5679	axios@1.13.2	1.16.0	1
enketo/enketo-express :3.0.4	dcad9c2273f6	axios@0.21.4	0.32.0	1
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	axios@0.21.4	0.32.0	1
etherpad/etherpad :2.7.2	b723fe5f2594	axios@1.15.2	1.16.0	1
ethpandaops/blobscan-indexer :latest	c58eb9ffe446	axios@1.2.5	1.16.0	1
evoapicloud/evolution-api :latest	966625532d90	axios@1.13.2	1.16.0	1
f3ktech/recaptcha-v3-verifier :1.1.0	48e78987cf91	axios@1.13.2	1.16.0	1
factly/mande-web :0.34.1	742355964b0e	axios@0.22.0	0.32.0	1
fallenbagel/jellyseerr :latest	4538137bc5af	axios@1.10.0	1.16.0	1
fallenbagel/jellyseerr :1.7.0	6dcdb5ba5091	axios@1.3.4	1.16.0	1
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	axios@1.5.1	1.16.0	1
fiware/idm :8.3.3	a1b6ed4ae84f	axios@1.3.4	1.16.0	1
fiware/iotagent-ul :1.14.0	fe11f55a926d	axios@0.19.2	0.32.0	1
flanksource/canary-checker-ui :v1.4.281	764c84e550db	axios@1.6.2	1.16.0	1
fosrl/pangolin :1.13.0	c32ad797ab96	axios@1.13.2	1.16.0	1
ghostfolio/ghostfolio :3.7.0	e3c6ab53e49b	axios@0.21.4	0.32.0	1
governify/collector-dynamic :v1.3.0	6d3d1a5b46a9	axios@0.21.1	0.32.0	1
gristlabs/grist :0.7.9	6e71b1914a7e	axios@0.18.0	0.32.0	1
halkeye/irslackd :latest	7638bfba70b0	axios@0.18.1	0.32.0	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	axios@0.26.1	0.32.0	1