StackRadarChart IndexLive demo

CVE-2026-45820

High

Advisory

Published 22 Jul 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 20th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 34; of 17,781 indexed, latest versions
Container images: 32; deployed by those charts
Fix available: 1 of 1; affected package

fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 32 images.

Affected package	Affected versions	Fixed in	Images
fflatenpm	0.4.8, 0.7.4, 0.8.1, 0.8.2	0.4.9, 0.7.5, 0.8.3	32

OSV records: GHSA-px8p-9vwx-vf98

Charts affected

34 by stars

Chart

Latest

Affected images

Radar Score

difydify-helm

1 of 11 See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
langgenius/dify-web :1.16.1	87dd47e4e28f	fflate@0.7.4	0.7.5

Open the chart page →

22,002

wazuhwazuh-helm-morgoved

1 of 5 See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.3	91e4f0a7feed	fflate@0.8.2	0.8.3

Open the chart page →

11,384

n8nn8n

1 of 1 See more

5,639

redisinsightredisinsight-gui

1 of 1 See more

redisinsight redisinsight-gui 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
redis/redisinsight :3.8	b5e19ee240ab	fflate@0.8.2	0.8.3

Open the chart page →

1,038

wazuhwazuh-helm

1 of 4 See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.11.1	0c58e7b47bb6	fflate@0.4.8	0.4.9

Open the chart page →

6,168

kubernetes-loggingkubernetes-logging

1 of 6 See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.10.0	485a0019e5d6	fflate@0.4.8	0.4.9

Open the chart page →

10,530

convertigoconvertigo

1 of 5 See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
baserow/baserow :1.30.1	df0c42eb67e8	fflate@0.4.8	0.4.9

Open the chart page →

17,404

n8none-acre-fund

1 of 3 See more

7,776

nocodbzekker6

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	fflate@0.8.2	0.8.3

Open the chart page →

4,016

opensearch-dashboardscaptnbp

1 of 1 See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.15.0	b7c26c60bfaf	fflate@0.4.8	0.4.9

Open the chart page →

1,843

ethereumjsethereum-helm-charts

1 of 2 See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
ethpandaops/ethereumjs :master	fb84b718500f	fflate@0.8.2	0.8.3

Open the chart page →

1,442

cap-captcha-serverf3k-tech

1 of 1 See more

cap-captcha-server f3k-tech 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
tiago2/cap :2.1	59f5ae4e261e	fflate@0.8.2	0.8.3

Open the chart page →

1,664

recipesgeek-cookbook

1 of 2 See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	fflate@0.4.8	0.4.9

Open the chart page →

7,801

growthbookgrowthbook

1 of 2 See more

growthbook growthbook 5.0.1

1 of the 2 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
growthbook/growthbook :5.0.1	f53ead646b5f	fflate@0.8.1	0.8.3

Open the chart page →

709

immichimmich-helm

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	fflate@0.8.2	0.8.3

Open the chart page →

15,712

n8nn8n-helm

1 of 1 See more

2,575

patchworkpatchwork

1 of 2 See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/patchwork :main	c01e018bced4	fflate@0.8.2	0.8.3

Open the chart page →

2,083

colosseumbook-k8sinfra-v2

2 of 5 See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
sysnet4admin/colosseum-cms :log	e74b43c7f492	fflate@0.8.2	0.8.3
sysnet4admin/colosseum-prm :log	5802bfcd7fed	fflate@0.8.2	0.8.3

Open the chart page →

26,996

wazuhcsic-charts

1 of 4 See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.4.1	1787550d2358	fflate@0.4.8	0.4.9

Open the chart page →

13,852

dapr-agentsdapr-agents-dev

1 of 31 See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
redis/redisinsight :latest	b5e19ee240ab	fflate@0.8.2	0.8.3

Open the chart page →

22,193

adventurelogdjjudas21

1 of 3 See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	fflate@0.8.2	0.8.3

Open the chart page →

7,459

mandefactly

1 of 3 See more

mande factly 0.5.16

1 of the 3 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
factly/mande-web :0.34.1	742355964b0e	fflate@0.4.8	0.4.9

Open the chart page →

4,777

canary-checkerflanksource

1 of 2 See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
flanksource/canary-checker-ui :v1.4.281	764c84e550db	fflate@0.8.2	0.8.3

Open the chart page →

4,650

n8njanip81-helm-charts

1 of 1 See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
n8nio/n8n :1.86.0	8b39ed5a2de9	fflate@0.7.4	0.7.5

Open the chart page →

5,826

redisinsightklicktipp

1 of 1 See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
redis/redisinsight :3.2.0	55542a762210	fflate@0.8.2	0.8.3

Open the chart page →

1,290

redisinsightlogic3579

1 of 1 See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
redis/redisinsight :3.4	85562d67a912	fflate@0.8.2	0.8.3

Open the chart page →

1,490

redisinsightredisinsight

1 of 1 See more

redisinsight redisinsight 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
redis/redisinsight :latest	b5e19ee240ab	fflate@0.8.2	0.8.3

Open the chart page →

1,038

retromretsamedoc

1 of 1 See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	fflate@0.8.2	0.8.3

Open the chart page →

7,084

retail-store-sample-checkout-chartstacksimplify

1 of 1 See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	fflate@0.8.2	0.8.3

Open the chart page →

1,313

thanhvt27-lab-k8sthanh-vt

1 of 5 See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
redis/redisinsight :latest	b5e19ee240ab	fflate@0.8.2	0.8.3

Open the chart page →

4,661

sirenwateim

1 of 1 See more

5,984

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	fflate@0.8.2	0.8.3

Open the chart page →

5,484

workadventureworkadventure

1 of 9 See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	fflate@0.4.8	0.4.9

Open the chart page →

16,083

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-45820.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	fflate@0.4.8	0.4.9

Open the chart page →

9,381

Container images carrying it

32 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
redis/redisinsight :3.8 :latest	b5e19ee240ab	fflate@0.8.2	0.8.3	4
baserow/baserow :1.30.1	df0c42eb67e8	fflate@0.4.8	0.4.9	1
ethpandaops/ethereumjs :master	fb84b718500f	fflate@0.8.2	0.8.3	1
factly/mande-web :0.34.1	742355964b0e	fflate@0.4.8	0.4.9	1
flanksource/canary-checker-ui :v1.4.281	764c84e550db	fflate@0.8.2	0.8.3	1
growthbook/growthbook :5.0.1	f53ead646b5f	fflate@0.8.1	0.8.3	1
langgenius/dify-web :1.16.1	87dd47e4e28f	fflate@0.7.4	0.7.5	1
n8nio/n8n :2.25.7	761374d4eb84	fflate@0.7.4	0.7.5	1
n8nio/n8n :1.86.0	8b39ed5a2de9	fflate@0.7.4	0.7.5	1
n8nio/n8n :0.212.0	a9195bc499a3	fflate@0.7.4	0.7.5	1
n8nio/n8n :1.33.1	dd171d45102a	fflate@0.7.4	0.7.5	1
nocodb/nocodb :0.301.5	d9516f0bf546	fflate@0.8.2	0.8.3	1
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	fflate@0.4.8	0.4.9	1
opensearchproject/opensearch-dashboards :2.10.0	485a0019e5d6	fflate@0.4.8	0.4.9	1
opensearchproject/opensearch-dashboards :2.15.0	b7c26c60bfaf	fflate@0.4.8	0.4.9	1
redis/redisinsight :3.2.0	55542a762210	fflate@0.8.2	0.8.3	1
redis/redisinsight :3.4	85562d67a912	fflate@0.8.2	0.8.3	1
sigp/siren :v3.0.4	2c219b04758e	fflate@0.8.2	0.8.3	1
sysnet4admin/colosseum-cms :log	e74b43c7f492	fflate@0.8.2	0.8.3	1
sysnet4admin/colosseum-prm :log	5802bfcd7fed	fflate@0.8.2	0.8.3	1
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	fflate@0.4.8	0.4.9	1
tiago2/cap :2.1	59f5ae4e261e	fflate@0.8.2	0.8.3	1
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	fflate@0.4.8	0.4.9	1
wazuh/wazuh-dashboard :4.11.1	0c58e7b47bb6	fflate@0.4.8	0.4.9	1
wazuh/wazuh-dashboard :4.4.1	1787550d2358	fflate@0.4.8	0.4.9	1
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	fflate@0.8.2	0.8.3	1
wazuh/wazuh-dashboard :4.14.3	91e4f0a7feed	fflate@0.8.2	0.8.3	1
ghcr.io/bryopsida/patchwork :main	c01e018bced4	fflate@0.8.2	0.8.3	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	fflate@0.8.2	0.8.3	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	fflate@0.8.2	0.8.3	1
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	fflate@0.8.2	0.8.3	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	fflate@0.8.2	0.8.3	1