StackRadarChart IndexLive demo

CVE-2026-45740

Medium

Advisory

Published 19 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 18th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 116; of 17,781 indexed, latest versions
Container images: 113; deployed by those charts
Fix available: 1 of 1; affected package

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 113 images.

Affected package	Affected versions	Fixed in	Images
protobufjsnpm	5.0.3, 6.8.6, 6.8.8, 6.8.9+19 more	7.5.8, 8.2.0	113

OSV records: GHSA-jggg-4jg4-v7c6

Charts affected

116 by stars

Chart

Latest

Affected images

Radar Score

outlineschmitzis

1 of 4 See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
outlinewiki/outline :0.69.1	d060dcd8f9aa	protobufjs@7.1.2	7.5.8

Open the chart page →

4,431

1 of 1 See more

k8soketi soketi 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	protobufjs@6.11.3	7.5.8

Open the chart page →

2,267

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	protobufjs@7.4.0	7.5.8

Open the chart page →

15,635

speckle-server-branch-testing6speckle

2.25.10-branch.testing6.645-b125c1e

1 of 4 See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	protobufjs@7.4.0	7.5.8

Open the chart page →

11,100

retail-store-sample-checkout-chartstacksimplify

1 of 1 See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	protobufjs@7.5.3	7.5.8

Open the chart page →

1,313

fdi-dotstatsuite-dlmstatcan

1 of 1 See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	protobufjs@6.11.2	7.5.8

Open the chart page →

3,881

pachydermstatcan

1 of 4 See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	protobufjs@5.0.3	7.5.8

Open the chart page →

4,967

1 of 1 See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	protobufjs@6.8.9	7.5.8

Open the chart page →

3,827

supabaseteochenglim

1 of 13 See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
supabase/storage-api :latest	f6c42a04163d	protobufjs@7.5.6	7.5.8

Open the chart page →

9,556

csmmth-charts

1 of 3 See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
catalysm/csmm :latest	f003b35f54d9	protobufjs@6.11.2	7.5.8

Open the chart page →

3,576

thingsboardthingsboard

1 of 12 See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
thingsboard/tb-js-executor :3.4.1	13e1eadf8ace	protobufjs@6.11.3	7.5.8

Open the chart page →

25,394

kubernetes-external-secretstrozz

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	protobufjs@6.10.2	7.5.8

Open the chart page →

2,838

evolution-apivcnngr

1 of 5 See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	protobufjs@7.5.4	7.5.8

Open the chart page →

3,746

temporalwenerme

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	protobufjs@6.10.2	7.5.8

Open the chart page →

22,665

kibanawiremind

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	protobufjs@7.2.5	7.5.8

Open the chart page →

6,285

workadventureworkadventure

3 of 9 See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-45740.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	protobufjs@7.2.4	7.5.8
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	protobufjs@7.2.4	7.5.8
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	protobufjs@7.2.4	7.5.8

Open the chart page →

16,083

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/homarr-labs/homarr :v1.77.0	f23ad77a681b	protobufjs@7.4.0	7.5.8	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	protobufjs@7.5.4	7.5.8	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	protobufjs@7.4.0	7.5.8	1
ghcr.io/karakeep-app/karakeep :0.33.2	b069e4307dec	protobufjs@7.5.6	7.5.8	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	protobufjs@7.2.6	7.5.8	1
ghcr.io/middleware-labs/odigos-odiglet :middleware-test-0.0.1	03c8c835ecee	protobufjs@7.2.2	7.5.8	1
ghcr.io/middleware-labs/vision-odiglet :middleware-test-0.0.3	bce34c98668e	protobufjs@7.2.2	7.5.8	1
ghcr.io/open-telemetry/demo :1.12.0-frontend	8b348f00ca4c	protobufjs@7.3.0	7.5.8	1
ghcr.io/open-telemetry/demo :1.12.0-paymentservice	b0f13eef3abf	protobufjs@7.2.5	7.5.8	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	protobufjs@7.5.3	7.5.8	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	protobufjs@7.2.5	7.5.8	1
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	protobufjs@6.11.3	7.5.8	1
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	protobufjs@6.8.9	7.5.8	1