StackRadar

CVE-2026-48712

High

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
118
of 17,781 indexed, latest versions
Container images
115
deployed by those charts
Fix available
1 of 1
affected package

protobufjs: Denial of service through unbounded Any expansion during JSON conversion

Carried by container images the latest versions of 118 of 17,781 indexed charts deploy, on 115 images.

Affected packageAffected versionsFixed inImages
protobufjsnpm5.0.3, 6.8.6, 6.8.8, 6.8.9+21 more7.6.1, 8.4.1115
OSV records
GHSA-wcpc-wj8m-hjx6

Charts affected

118 by stars
ChartLatestAffected imagesRadar Score
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
protobufjs@7.5.4
7.6.1

Open the chart page →

4,684
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
protobufjs@7.0.0
7.6.1

Open the chart page →

5,582
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
protobufjs@7.1.2
7.6.1

Open the chart page →

4,431
k8soketisoketi1.0.11 of 1See more

k8soketi soketi 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
protobufjs@6.11.3
7.6.1

Open the chart page →

2,267
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
protobufjs@7.4.0
7.6.1

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
protobufjs@7.4.0
7.6.1

Open the chart page →

11,100
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
protobufjs@7.5.3
7.6.1

Open the chart page →

1,313
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
protobufjs@6.11.2
7.6.1

Open the chart page →

3,881
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs@5.0.3
7.6.1

Open the chart page →

4,967
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
protobufjs@6.8.9
7.6.1

Open the chart page →

3,827
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
supabase/storage-api:latestf6c42a04163d
protobufjs@7.5.6
7.6.1

Open the chart page →

9,556
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
protobufjs@6.11.2
7.6.1

Open the chart page →

3,576
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
thingsboard/tb-js-executor:3.4.113e1eadf8ace
protobufjs@6.11.3
7.6.1

Open the chart page →

25,394
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
protobufjs@6.10.2
7.6.1

Open the chart page →

2,838
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
protobufjs@7.5.4
7.6.1

Open the chart page →

3,746
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
protobufjs@6.10.2
7.6.1

Open the chart page →

22,665
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
protobufjs@7.2.5
7.6.1

Open the chart page →

6,285
workadventureworkadventure1.1.03 of 9See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-48712.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
protobufjs@7.2.4
7.6.1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
protobufjs@7.2.4
7.6.1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
protobufjs@7.2.4
7.6.1

Open the chart page →

16,083

Container images carrying it

115 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
louislam/uptime-kuma:2.5.33e24e96c89ef
protobufjs@7.2.6
7.6.1
1
louislam/uptime-kuma:2.0.24c364ef96aad
protobufjs@7.2.6
7.6.1
1
louislam/uptime-kuma:2.4.091e963bfda56
protobufjs@7.2.6
7.6.1
1
louislam/uptime-kuma:1.23.1396510915e6be
protobufjs@7.2.6
7.6.1
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
protobufjs@7.2.6
7.6.1
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
protobufjs@7.2.6
7.6.1
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
protobufjs@7.0.0
7.6.1
1
mishtinetwork/operator:latestbb3fe67a5f7c
protobufjs@7.3.2
7.6.1
1
mitchxxx/amazon:214e72480ec63a
protobufjs@6.11.3
7.6.1
1
n8nio/n8n:2.25.7761374d4eb84
protobufjs@7.5.8
7.6.1
1
n8nio/n8n:1.86.08b39ed5a2de9
protobufjs@7.4.0
7.6.1
1
n8nio/n8n:1.33.1dd171d45102a
protobufjs@7.2.4
7.6.1
1
nocodb/nocodb:0.301.5d9516f0bf546
protobufjs@7.5.4
7.6.1
1
obolnetwork/charon-dkg-sidecar:maine263be0a7440
protobufjs@6.11.4
7.6.1
1
ooghenekaro/amazon:latest03394ba1d6d8
protobufjs@7.2.3
7.6.1
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
protobufjs@7.3.2
7.6.1
1
outlinewiki/outline:0.82.0494dfb9249a6
protobufjs@7.2.6
7.6.1
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs@5.0.3
7.6.1
1
qxip/qryn:3.2.3977acc9c7a9fd
protobufjs@7.4.0
7.6.1
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
protobufjs@7.4.0
7.6.1
1
roadiehq/community-backstage-image:latestef355bf5b639
protobufjs@6.11.2
7.6.1
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
protobufjs@6.11.2
7.6.1
1
slagattollas/weatherservice-practica:latest68e7f56393fc
protobufjs@6.8.8
7.6.1
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
protobufjs@7.4.0
7.6.1
1
speckle/speckle-server:2.26.379f14a2bf931
protobufjs@7.4.0
7.6.1
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
protobufjs@7.4.0
7.6.1
1
supabase/storage-api:v1.60.4c8eb9858eafe
protobufjs@8.0.1
8.4.1
1
supabase/storage-api:latestf6c42a04163d
protobufjs@7.5.6
7.6.1
1
supabase/storage-api:v1.12.0f983fb50bd95
protobufjs@7.4.0
7.6.1
1
temporalio/web:1.14.033cfa863d8ce
protobufjs@6.10.2
7.6.1
1
thecodingmachine/workadventure-back:v1.17.764001369dad5
protobufjs@7.2.4
7.6.1
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
protobufjs@7.2.4
7.6.1
1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
protobufjs@7.2.4
7.6.1
1
thingsboard/tb-js-executor:3.4.113e1eadf8ace
protobufjs@6.11.3
7.6.1
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
protobufjs@6.11.2
7.6.1
1
winfred008/amazon:910a68de5b398
protobufjs@6.11.3
7.6.1
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
protobufjs@7.3.2
7.6.1
1
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
protobufjs@6.10.2
7.6.1
1
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
protobufjs@5.0.3
7.6.1
1
ghcr.io/backstage/backstage:latest792e262ea504
protobufjs@7.5.5
7.6.1
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
protobufjs@7.4.0
7.6.1
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
protobufjs@7.4.0
7.6.1
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
protobufjs@7.4.0
7.6.1
1
ghcr.io/data-fair/notify:3c739b74dabb0
protobufjs@7.4.0
7.6.1
1
ghcr.io/data-fair/processings:15a9216989707
protobufjs@6.8.6
7.6.1
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
protobufjs@6.10.2
7.6.1
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
protobufjs@7.4.0
7.6.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
protobufjs@7.5.3
7.6.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
protobufjs@7.5.3
7.6.1
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
protobufjs@7.5.5
7.6.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.