StackRadar

CVE-2026-55602

Medium

Advisory

Published 18 Jun 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
74
of 17,781 indexed, latest versions
Container images
69
deployed by those charts
Fix available
1 of 1
affected package

http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

Carried by container images the latest versions of 74 of 17,781 indexed charts deploy, on 69 images.

Affected packageAffected versionsFixed inImages
http-proxy-middlewarenpm0.17.3, 0.17.4, 0.18.0, 0.19.1+12 more2.0.10, 3.0.669
OSV records
GHSA-64mm-vxmg-q3vj

Charts affected

74 by stars
ChartLatestAffected imagesRadar Score
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

7,210
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

9,203
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
http-proxy-middleware@2.0.9
2.0.10

Open the chart page →

1,339
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

5,251
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
http-proxy-middleware@0.19.2
2.0.10

Open the chart page →

8,213
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

3,795
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
http-proxy-middleware@1.3.1
2.0.10

Open the chart page →

7,579
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
http-proxy-middleware@1.0.6
2.0.10

Open the chart page →

6,868
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
http-proxy-middleware@2.0.4
2.0.10

Open the chart page →

18,517
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
http-proxy-middleware@2.0.9
2.0.10

Open the chart page →

4,016
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
http-proxy-middleware@1.3.1
2.0.10

Open the chart page →

1,341
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
http-proxy-middleware@1.3.1
2.0.10
ghcr.io/data-fair/metrics:0a8d40779eeae
http-proxy-middleware@1.3.1
2.0.10
ghcr.io/data-fair/notify:3c739b74dabb0
http-proxy-middleware@1.3.1
2.0.10
ghcr.io/data-fair/portals:18b621866ceb2
http-proxy-middleware@1.3.1
2.0.10
ghcr.io/data-fair/processings:15a9216989707
http-proxy-middleware@1.3.1
2.0.10
ghcr.io/data-fair/simple-directory:438a4f32fad82
http-proxy-middleware@1.3.1
2.0.10

Open the chart page →

38,346
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

3,925
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

7,801
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
http-proxy-middleware@1.3.1
2.0.10

Open the chart page →

3,143
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

5,940
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
http-proxy-middleware@3.0.5
3.0.6

Open the chart page →

2,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
http-proxy-middleware@2.0.9
2.0.10

Open the chart page →

31,844
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

7,517
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

12,581
angular-chartangular-application0.1.01 of 1See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ibarreche/cloud-front-ci:latestc8970ac1c8dc
http-proxy-middleware@0.18.0
2.0.10

Open the chart page →

3,237
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
http-proxy-middleware@2.0.3
2.0.10

Open the chart page →

2,396
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
http-proxy-middleware@2.0.4
2.0.10

Open the chart page →

18,277
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

25,456
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

5,141
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

12,907
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

9,146
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

3,744
multichain-proxyethersphereVerified publisher0.1.01 of 1See more

multichain-proxy ethersphere 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ethersphere/multichain-proxy:0.0.261f5419afbcd
http-proxy-middleware@3.0.3
3.0.6

Open the chart page →

795
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
http-proxy-middleware@0.19.2
2.0.10

Open the chart page →

8,213
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

3,407
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
http-proxy-middleware@0.17.4
2.0.10

Open the chart page →

32,915
ilum-marquezilumVerified publisher6.7.01 of 3See more

ilum-marquez ilum 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ilum/marquez-web:0.53.2716437a51a6c
http-proxy-middleware@2.0.9
2.0.10

Open the chart page →

6,254
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
http-proxy-middleware@2.0.7
2.0.10

Open the chart page →

11,812
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
http-proxy-middleware@2.0.0
2.0.10

Open the chart page →

7,232
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
http-proxy-middleware@0.17.4
2.0.10

Open the chart page →

6,454
skoonerkfirfer0.0.61 of 1See more

skooner kfirfer 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
http-proxy-middleware@1.3.1
2.0.10

Open the chart page →

1,341
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
kitware/cdash:v5.3.0d7767d9b9da4
http-proxy-middleware@2.0.9
2.0.10

Open the chart page →

12,062
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

3,651
kubevismario-fVerified publisher2.0.11 of 1See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

5,287
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

5,940
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
http-proxy-middleware@2.0.9
2.0.10

Open the chart page →

9,668
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
http-proxy-middleware@3.0.5
3.0.6

Open the chart page →

14,809
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
http-proxy-middleware@3.0.5
3.0.6

Open the chart page →

2,318
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
http-proxy-middleware@0.19.1
2.0.10

Open the chart page →

6,438
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

2,116
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-55602.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
http-proxy-middleware@2.0.6
2.0.10

Open the chart page →

2,116

Container images carrying it

69 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
vlebediantsev/notes-project-front:latest945675fd2636
http-proxy-middleware@2.0.6
2.0.10
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
http-proxy-middleware@2.0.6
2.0.10
1
winfred008/amazon:910a68de5b398
http-proxy-middleware@2.0.6
2.0.10
1
ymuski/skooner:latest67819ca511b5
http-proxy-middleware@1.3.0
2.0.10
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
http-proxy-middleware@1.3.1
2.0.10
1
ghcr.io/data-fair/metrics:0a8d40779eeae
http-proxy-middleware@1.3.1
2.0.10
1
ghcr.io/data-fair/notify:3c739b74dabb0
http-proxy-middleware@1.3.1
2.0.10
1
ghcr.io/data-fair/portals:18b621866ceb2
http-proxy-middleware@1.3.1
2.0.10
1
ghcr.io/data-fair/processings:15a9216989707
http-proxy-middleware@1.3.1
2.0.10
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
http-proxy-middleware@1.3.1
2.0.10
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
http-proxy-middleware@2.0.6
2.0.10
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
http-proxy-middleware@3.0.5
3.0.6
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
http-proxy-middleware@0.19.1
2.0.10
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
http-proxy-middleware@2.0.9
2.0.10
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
http-proxy-middleware@2.0.6
2.0.10
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
http-proxy-middleware@0.19.1
2.0.10
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
http-proxy-middleware@0.19.1
2.0.10
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
http-proxy-middleware@0.19.1
2.0.10
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
http-proxy-middleware@2.0.9
2.0.10
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.