StackRadar

CVE-2026-67214

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
306
of 17,781 indexed, latest versions
Container images
317
deployed by those charts
Fix available
1 of 2
affected packages

nanoid: non-secure generators can loop indefinitely with negative size

Carried by container images the latest versions of 306 of 17,781 indexed charts deploy, on 317 images.

Affected packageAffected versionsFixed inImages
nanoidnpm2.1.11, 3.1.12, 3.1.16, 3.1.20+26 more3.3.16, 5.1.16317
node-postcssdeb8.4.31+~cs8.0.26-1no fix listed1
OSV records
GHSA-28wg-ghj8-5hjvUBUNTU-CVE-2026-67214

Charts affected

306 by stars
ChartLatestAffected imagesRadar Score
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
nanoid@3.3.11
3.3.16

Open the chart page →

1,442
cap-captcha-serverf3k-techVerified publisher0.21.01 of 1See more

cap-captcha-server f3k-tech 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
tiago2/cap:2.159f5ae4e261e
nanoid@5.1.5
5.1.16

Open the chart page →

1,664
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
nanoid@3.1.12
3.3.16

Open the chart page →

2,519
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
nanoid@3.2.0
3.3.16

Open the chart page →

4,260
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
nanoid@3.1.23
3.3.16

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
nanoid@3.2.0
3.3.16

Open the chart page →

7,801
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
nanoid@3.3.4
3.3.16

Open the chart page →

5,079
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
nanoid@2.1.11
3.3.16

Open the chart page →

4,410
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
nanoid@3.3.7
3.3.16

Open the chart page →

4,196
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nanoid@3.3.11
3.3.16

Open the chart page →

15,712
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nanoid@3.3.8
3.3.16

Open the chart page →

5,228
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
nanoid@3.3.11
3.3.16

Open the chart page →

2,770
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
nanoid@3.3.4
3.3.16

Open the chart page →

3,143
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
nanoid@3.3.6
3.3.16

Open the chart page →

20,403
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
nanoid@3.3.11
3.3.16

Open the chart page →

800
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest836467a50792
nanoid@3.3.7
3.3.16
chibisafe/chibisafe-server:latest3da4fcbc1a18
nanoid@3.3.7
3.3.16

Open the chart page →

5,654
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
glarad/mcp-management-portal-clr:0.6.8807e453354a7
nanoid@2.1.11
3.3.16

Open the chart page →

6,929
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
nanoid@3.3.11
3.3.16

Open the chart page →

2,575
kuttone-acre-fundVerified publisher0.2.51 of 1See more

kutt one-acre-fund 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
kutt/kutt:latestfa3d24a89b04
nanoid@3.3.8
3.3.16

Open the chart page →

454
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
nanoid@3.3.15
3.3.16

Open the chart page →

22,420
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
nanoid@3.3.11
3.3.16

Open the chart page →

6,873
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
nanoid@3.3.11
3.3.16

Open the chart page →

6,883
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
nanoid@3.3.11
3.3.16

Open the chart page →

7,035
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
nanoid@5.0.6
5.1.16

Open the chart page →

31,844
pumejwebapppumejnodejswebapp0.1.01 of 1See more

pumejwebapp pumejnodejswebapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
pumejlab/nodejs-webapp:latestf563eabcb819
nanoid@3.3.3
3.3.16

Open the chart page →

1,164
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
nanoid@5.1.7
5.1.16

Open the chart page →

5,482
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nanoid@3.3.8
3.3.16

Open the chart page →

2,823
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
nanoid@3.3.7
3.3.16

Open the chart page →

30,234
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
nanoid@3.3.11
3.3.16

Open the chart page →

38,107
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nanoid@3.3.11
3.3.16

Open the chart page →

5,213
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
nanoid@3.3.11
3.3.16

Open the chart page →

11,532
speckle-serverspeckleVerified publisher2.26.34 of 4See more

speckle-server speckle 2.26.3

4 of the 4 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.26.3d51e1b0cf231
nanoid@5.1.5
5.1.16
speckle/speckle-preview-service:2.26.3092384dba45d
nanoid@5.1.5
5.1.16
speckle/speckle-server:2.26.379f14a2bf931
nanoid@3.3.11
3.3.16
speckle/speckle-webhook-service:2.26.3c58eb372c488
nanoid@5.1.5
5.1.16

Open the chart page →

10,380
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
nanoid@3.3.7
3.3.16

Open the chart page →

12,581
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
nanoid@3.3.7
3.3.16

Open the chart page →

5,225
tdarrvhdirkVerified publisher5.0.51 of 2See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
nanoid@2.1.11
3.3.16

Open the chart page →

26,657
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
nanoid@3.2.0
3.3.16

Open the chart page →

3,833
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
nanoid@3.3.11
3.3.16

Open the chart page →

10,090
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
nanoid@3.3.1
3.3.16

Open the chart page →

9,783
trifidzazukoOfficialVerified publisher0.2.11 of 1See more

trifid zazuko 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
nanoid@3.3.12
3.3.16

Open the chart page →

338
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
nanoid@3.3.11
3.3.16
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
nanoid@3.3.11
3.3.16

Open the chart page →

3,600
admin-portaladmin-web-portal1.2.11 of 2See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
soulou2019/node-server:latest5e6ecfcc109e
nanoid@3.3.6
3.3.16

Open the chart page →

3,419
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nanoid@3.3.11
3.3.16

Open the chart page →

3,820
katalogalpineworks0.1.21 of 5See more

katalog alpineworks 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
nanoid@3.3.7
3.3.16

Open the chart page →

4,497
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
nanoid@3.3.3
3.3.16

Open the chart page →

3,437
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
nanoid@3.3.4
3.3.16

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
nanoid@3.3.4
3.3.16

Open the chart page →

2,396
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api-frontend:1.0.0b6a67099e4c5
nanoid@3.3.11
3.3.16

Open the chart page →

4,923
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
nanoid@3.3.4
3.3.16

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
nanoid@3.3.7
3.3.16

Open the chart page →

32,501
nas-appsawesomeVerified publisher2.0.01 of 8See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-67214.

Container imageDigestPackageFixed in
ltdstudio/terraforming-mars:latest0e76c6f4eac0
nanoid@3.1.23
3.3.16

Open the chart page →

7,152

Container images carrying it

317 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
nanoid@3.3.12
3.3.16
1
dacinfomotion/h2p:latest68fa393b472c
nanoid@3.3.3
3.3.16
1
danny1dockerhub/nodejswebapp:lateste434683fcc89
nanoid@3.3.3
3.3.16
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
nanoid@3.3.7
3.3.16
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nanoid@3.3.11
3.3.16
1
directus/directus:12.0.29c8470ea465c
nanoid@3.3.12
3.3.16
1
directus/directus:11.1.0e3c8bb975350
nanoid@3.3.7
3.3.16
1
diygod/rsshub:2025-11-097a6312cac0d5
nanoid@3.3.11
3.3.16
1
docmost/docmost:0.95.041c8d777cf23
nanoid@5.1.7
5.1.16
1
documenso/documenso:v1.8.17f16a9449f18
nanoid@3.3.7
3.3.16
1
drumsergio/lynxprompt:2.0.75c6afb6679301
nanoid@3.3.12
3.3.16
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
nanoid@3.3.11
3.3.16
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
nanoid@3.3.4
3.3.16
1
etherpad/etherpad:2.7.2b723fe5f2594
nanoid@5.1.9
5.1.16
1
ethersphere/bzz-token-service:latest7624f11a72ad
nanoid@3.1.20
3.3.16
1
ethersphere/onboarding-faucet:0.3.0513154aab230
nanoid@3.3.1
3.3.16
1
ethpandaops/blobscan:latest7a9ab6370657
nanoid@3.3.4
3.3.16
1
ethpandaops/ethereumjs:masterfb84b718500f
nanoid@3.3.11
3.3.16
1
factly/mande-web:0.34.1742355964b0e
nanoid@3.3.6
3.3.16
1
fallenbagel/jellyseerr:latest4538137bc5af
nanoid@3.3.8
3.3.16
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
nanoid@3.3.4
3.3.16
1
felipecs8/conversor-temperatura:v1f945423be36d
nanoid@3.3.11
3.3.16
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
nanoid@5.1.6
5.1.16
1
flanksource/incident-manager-ui:v1.4.318891f21df54fb
nanoid@5.1.6
5.1.16
1
fosrl/pangolin:1.13.0c32ad797ab96
nanoid@3.3.11
3.3.16
1
glarad/mcp-management-portal-clr:0.6.8807e453354a7
nanoid@2.1.11
3.3.16
1
hamid2021/nodejs-dockercli:latest429d99890c3c
nanoid@3.3.3
3.3.16
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
nanoid@2.1.11
3.3.16
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
nanoid@3.3.6
3.3.16
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
nanoid@3.3.6
3.3.16
1
heywood8/redisinsight:2.28.00bc9ab313d37
nanoid@3.1.20
3.3.16
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
nanoid@3.1.30
3.3.16
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
nanoid@3.3.11
3.3.16
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
nanoid@3.3.7
3.3.16
1
instill/console:0.68.54cd70e2df5c6
nanoid@3.3.11
3.3.16
1
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
nanoid@2.1.11
3.3.16
1
joplin/server:latest3f7b852959aa
nanoid@3.3.7
3.3.16
1
joplin/server:3.0-beta52af57880c0e
nanoid@3.3.7
3.3.16
1
joplin/server:2.14.2-betab87564ef34e9
nanoid@3.3.7
3.3.16
1
josepht05/titajo-docker:v1.0.0d94024965d78
nanoid@3.3.3
3.3.16
1
jupyterhub/jupyterhub:5.4.63974ba945e65
nanoid@4.0.2
node-postcss@8.4.31+~cs8.0.26-1
5.1.16
no fix listed
1
keyoxide/keyoxide:stable96f27a71269d
nanoid@3.3.1
3.3.16
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
nanoid@3.3.4
3.3.16
1
ktitilayo2/nodejswebapp:latest8bac28058688
nanoid@3.3.3
3.3.16
1
kubebb/bff-server:v0.2.0-202312040fbb732379bc
nanoid@3.3.4
3.3.16
1
kubebb/component-store:latestfd8ecbd73213
nanoid@3.3.6
3.3.16
1
kubevious/backend:1.2.22d9ba6eb46b6
nanoid@3.3.3
3.3.16
1
kubevious/collector:1.2.1f58226f9d84e
nanoid@3.3.3
3.3.16
1
kubevious/guard:1.2.19bf567704de2
nanoid@3.1.20
3.3.16
1
kubevious/parser:1.0.151acf1a1f0b47
nanoid@3.1.20
3.3.16
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.