StackRadarChart IndexLive demo

CVE-2026-67214

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.003; 26th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 305; of 17,787 indexed, latest versions
Container images: 316; deployed by those charts
Fix available: 1 of 2; affected packages

nanoid: non-secure generators can loop indefinitely with negative size

Carried by container images the latest versions of 305 of 17,787 indexed charts deploy, on 316 images.

Affected package	Affected versions	Fixed in	Images
nanoidnpm	2.1.11, 3.1.12, 3.1.16, 3.1.20+26 more	3.3.16, 5.1.16	316
node-postcssdeb	8.4.31+~cs8.0.26-1	no fix listed	1

OSV records: GHSA-28wg-ghj8-5hjv UBUNTU-CVE-2026-67214

Charts affected

305 by stars

Chart

Latest

Affected images

Radar Score

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-67214.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	nanoid@2.1.11	3.3.16

Open the chart page →

28,605

opensearch-dashboardswenerme

1 of 1 See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-67214.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :3.8.0	ca28e40a095f	nanoid@5.1.9	5.1.16

Open the chart page →

280

wikiwikijs

1 of 2 See more

5,459

kibanawiremind

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-67214.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	nanoid@3.3.8	3.3.16

Open the chart page →

6,285

workadventureworkadventure

3 of 9 See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-67214.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	nanoid@3.3.6	3.3.16
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	nanoid@3.3.6	3.3.16
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	nanoid@3.3.6	3.3.16

Open the chart page →

16,083

Container images carrying it

316 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/wgbh-mla/ov-frontend :v1.1.0	bfc3118f6565	nanoid@3.3.11	3.3.16	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	nanoid@3.3.7	3.3.16	1
ghcr.io/zazuko/trifid :v6.0.1	59bda2bf65d4	nanoid@3.3.12	3.3.16	1
ghcr.io/zoriya/kyoo_front :4.7.1	d7f76c9c65d9	nanoid@3.3.7	3.3.16	1
public.ecr.aws/flanksource/incident-manager-ui :v1.4.317	fea799d4fb2f	nanoid@5.1.6	5.1.16	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	nanoid@3.3.1	3.3.16	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	nanoid@3.3.1	3.3.16	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	nanoid@3.3.1	3.3.16	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	nanoid@3.1.28	3.3.16	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	nanoid@3.3.11	3.3.16	1
quay.io/kuberay/dashboard :v1.7.0	7e43d4b4fd9f	nanoid@3.3.11	3.3.16	1
quay.io/mongodb/farm-intro-frontend :0.1	99ccdfd543e1	nanoid@3.1.16	3.3.16	1
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	nanoid@4.0.0	5.1.16	1
quay.io/wekan/wekan :v5.65	cb17600883a3	nanoid@3.1.22	3.3.16	1
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	nanoid@3.3.11	3.3.16	1
registry.gitlab.com/dyff/dyff-frontend :0.20.1	52549f52ae53	nanoid@3.3.11	3.3.16	1