CVE-2026-48617

High

Advisory

Published 18 Jun 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 64; of 17,781 indexed, latest versions
Container images: 57; deployed by those charts
Fix available: 1 of 5; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 64 of 17,781 indexed charts deploy, on 57 images.

Affected package	Affected versions	Fixed in	Images
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+34 more	no fix listed	46
nodejsapk	22.16.0-r2, 22.22.0-r0, 24.11.1-r0, 24.14.1-r0	22.23.0-r0, 24.17.0-r0	7
nodejs-25apk	25.2.1-r0, 25.8.1-r0	no fix listed	2
nodejs-18apk	18.20.8-r9	no fix listed	1
nodejs-20apk	20.18.3-r0	no fix listed	1

OSV records: ALPINE-CVE-2026-48617 DEBIAN-CVE-2026-48617 CGA-52mh-4gcr-5r65 CGA-535m-qjwr-8mpf CGA-qcj4-g4rg-7r8r UBUNTU-CVE-2026-48617
Also known as: CGA-9m8x-9gq9-3wc2, CGA-w25m-c9rr-qc3m, CGA-wg5x-pp9h-q52m

Charts affected

64 by stars

Chart

Latest

Affected images

Radar Score

coolifyquench-coolify

0.0.17

1 of 4 See more

coolify quench-coolify 0.0.17

1 of the 4 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned	f128e512c9c0	nodejs-18@18.20.8-r9	no fix listed

Open the chart page →

433

coolify-realtimequench-coolify-realtime

0.0.7

1 of 1 See more

coolify-realtime quench-coolify-realtime 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned	f128e512c9c0	nodejs-18@18.20.8-r9	no fix listed

Open the chart page →

306

dgraphromholdings

0.0.20

1 of 1 See more

dgraph romholdings 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
dgraph/dgraph :v21.12.0	3b55ea83fffe	nodejs@14.17.5-deb-1nodesource1	no fix listed

Open the chart page →

11,909

tandoorrtomik-helm-charts

0.0.1

1 of 1 See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
vabene1111/recipes :2.3.5	0f8d061895e9	nodejs@22.16.0-r2	22.23.0-r0

Open the chart page →

4,499

runwhen-localrunwhen-contrib

0.6.17

1 of 3 See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
ghcr.io/runwhen-contrib/runwhen-local :0.12.0	533ce58c6e02	nodejs@26.8.1-1nodesource1	no fix listed

Open the chart page →

3,707

showroom-docs-mcpshowroom-docs-mcp

2.1.0

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	nodejs-25@25.8.1-r0	no fix listed

Open the chart page →

5,201

frontendsignalen

4.24.0

1 of 1 See more

frontend signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
signalen/frontend :2.27.8	1ab79cb7fe21	nodejs@24.14.1-r0	24.17.0-r0

Open the chart page →

1,161

grafanasvtech-public-helm-charts

1.0.0

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	nodejs@10.19.0~dfsg-3ubuntu1.3	no fix listed

Open the chart page →

10,902

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	nodejs@20.20.2-1nodesource1	no fix listed

Open the chart page →

7,248

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	nodejs@20.11.1-1nodesource1	no fix listed

Open the chart page →

9,347

video-dl-botvideo-dl-bot

1.4.3

1 of 1 See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	nodejs@24.20.0-1nodesource1	no fix listed

Open the chart page →

1,961

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

28,605

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48617.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	nodejs@20.15.0-1nodesource1	no fix listed

Open the chart page →

14,100

Container images carrying it

57 by charts deploying them

A fixed version is listed for 1 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	nodejs@14.17.2-deb-1nodesource1	no fix listed	1
ghcr.io/kagent-dev/doc2vec/mcp :1.1.14	ace1de323f4a	nodejs-25@25.2.1-r0	no fix listed	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	nodejs@18.20.8-1nodesource1	no fix listed	1
ghcr.io/lerentis/bitwarden-crd-operator :0.17.0	0a608c6ead85	nodejs@24.14.1-r0	24.17.0-r0	1
ghcr.io/runwhen-contrib/runwhen-local :0.12.0	533ce58c6e02	nodejs@26.8.1-1nodesource1	no fix listed	1
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	nodejs@24.20.0-1nodesource1	no fix listed	1
public.ecr.aws/aktosecurity/akto-puppeteer-replay :1.49.4_latest	f1c5763d565e	nodejs@24.14.1-r0	24.17.0-r0	1