CVE-2026-58041

Medium

Advisory

Published 4 Aug 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 17th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 65; of 17,781 indexed, latest versions
Container images: 57; deployed by those charts
Fix available: 1 of 4; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 65 of 17,781 indexed charts deploy, on 57 images.

Affected package	Affected versions	Fixed in	Images
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+34 more	no fix listed	46
nodejsapk	24.11.1-r0, 24.14.1-r0, 24.17.0-r0	24.18.1-r0	8
nodejs-25apk	25.2.1-r0, 25.8.1-r0	no fix listed	2
nodejs-20apk	20.18.3-r0	no fix listed	1

OSV records: ALPINE-CVE-2026-58041 DEBIAN-CVE-2026-58041 UBUNTU-CVE-2026-58041 CGA-2952-935m-xv93 CGA-9wvr-5vf8-r8hx
Also known as: CGA-jh5r-g638-2q4p, CGA-rg6h-865r-9pj4

Charts affected

65 by stars

Chart

Latest

Affected images

Radar Score

example-dev-toolsnoygal

0.2.8

1 of 3 See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
linuxserver/codimd :latest	b801bbcf6386	nodejs@10.23.0-1nodesource1	no fix listed

Open the chart page →

27,465

comacopencord

1.0.0

1 of 9 See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
omecproject/onos-progran :1.0.0	5715e5648aa0	nodejs@8.9.4-1nodesource1	no fix listed

Open the chart page →

88,546

onos-progranopencord

1.2.7

1 of 2 See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
muluder/prograncontrollermcord :0.1.8	43b597a93da7	nodejs@8.9.4-1nodesource1	no fix listed

Open the chart page →

38,865

openwhiskopenwhisk

1.0.0

1 of 10 See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
openwhisk/ow-utils :1.0.0	c80dba0de3aa	nodejs@8.10.0~dfsg-2ubuntu0.4	no fix listed

Open the chart page →

36,215

dgraphromholdings

0.0.20

1 of 1 See more

dgraph romholdings 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
dgraph/dgraph :v21.12.0	3b55ea83fffe	nodejs@14.17.5-deb-1nodesource1	no fix listed

Open the chart page →

11,909

runwhen-localrunwhen-contrib

0.6.17

1 of 3 See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
ghcr.io/runwhen-contrib/runwhen-local :0.12.0	533ce58c6e02	nodejs@26.8.1-1nodesource1	no fix listed

Open the chart page →

3,707

showroom-docs-mcpshowroom-docs-mcp

2.1.0

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	nodejs-25@25.8.1-r0	no fix listed

Open the chart page →

5,201

frontendsignalen

4.24.0

1 of 1 See more

frontend signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
signalen/frontend :2.27.8	1ab79cb7fe21	nodejs@24.14.1-r0	24.18.1-r0

Open the chart page →

1,161

grafanasvtech-public-helm-charts

1.0.0

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	nodejs@10.19.0~dfsg-3ubuntu1.3	no fix listed

Open the chart page →

10,902

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	nodejs@20.20.2-1nodesource1	no fix listed

Open the chart page →

7,248

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	nodejs@20.11.1-1nodesource1	no fix listed

Open the chart page →

9,347

video-dl-botvideo-dl-bot

1.4.3

1 of 1 See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	nodejs@24.20.0-1nodesource1	no fix listed

Open the chart page →

1,961

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nodejs@14.18.1-deb-1nodesource1	no fix listed

Open the chart page →

28,605

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-58041.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	nodejs@20.15.0-1nodesource1	no fix listed

Open the chart page →

14,100

Container images carrying it

57 by charts deploying them

A fixed version is listed for 1 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/kagent-dev/doc2vec/mcp :1.1.14	ace1de323f4a	nodejs-25@25.2.1-r0	no fix listed	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	nodejs@18.20.8-1nodesource1	no fix listed	1
ghcr.io/lerentis/bitwarden-crd-operator :0.17.0	0a608c6ead85	nodejs@24.14.1-r0	24.18.1-r0	1
ghcr.io/mkutlak/alluredeck-api :0.41.0	fa429df90c68	nodejs@24.17.0-r0	24.18.1-r0	1
ghcr.io/runwhen-contrib/runwhen-local :0.12.0	533ce58c6e02	nodejs@26.8.1-1nodesource1	no fix listed	1
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	nodejs@24.20.0-1nodesource1	no fix listed	1
public.ecr.aws/aktosecurity/akto-puppeteer-replay :1.49.4_latest	f1c5763d565e	nodejs@24.14.1-r0	24.18.1-r0	1