StackRadar

CVE-2026-67318

Medium

Advisory

Published 20 Jul 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
36th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
55
of 17,781 indexed, latest versions
Container images
46
deployed by those charts
Fix available
1 of 1
affected package

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Carried by container images the latest versions of 55 of 17,781 indexed charts deploy, on 46 images.

Affected packageAffected versionsFixed inImages
axiosnpm1.13.0, 1.13.2, 1.13.3, 1.13.5+7 more1.18.046
OSV records
GHSA-mwf2-3pr3-8698

Charts affected

55 by stars
ChartLatestAffected imagesRadar Score
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-67318.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
axios@1.17.0
1.18.0

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-67318.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
axios@1.13.6
1.18.0

Open the chart page →

2,028
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-67318.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
axios@1.13.2
1.18.0

Open the chart page →

3,746
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-67318.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
axios@1.16.1
1.18.0

Open the chart page →

1,787
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-67318.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
axios@1.15.2
1.18.0

Open the chart page →

5,459

Container images carrying it

46 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
redis/redisinsight:3.8:latestb5e19ee240ab
axios@1.16.0
1.18.0
4
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
axios@1.15.0
1.18.0
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
axios@1.13.6
1.18.0
3
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
axios@1.13.0
1.18.0
2
requarks/wiki:2:latest68f0d1848261
axios@1.15.2
1.18.0
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
axios@1.16.0
1.18.0
2
budibase/apps:3.41.344fe6feab985
axios@1.15.2
1.18.0
1
chainsafe/lodestar:latest5593f6e97912
axios@1.13.3
1.18.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
axios@1.17.0
1.18.0
1
dbgate/dbgate:7.2.0-alpine287077002446
axios@1.17.0
1.18.0
1
directus/directus:12.0.29c8470ea465c
axios@1.16.1
1.18.0
1
docmost/docmost:0.95.041c8d777cf23
axios@1.16.0
1.18.0
1
eclipseaerios/self-orchestrator:1.2.08b123bec5679
axios@1.13.2
1.18.0
1
etherpad/etherpad:2.7.2b723fe5f2594
axios@1.15.2
1.18.0
1
evoapicloud/evolution-api:latest966625532d90
axios@1.13.2
1.18.0
1
f3ktech/recaptcha-v3-verifier:1.1.048e78987cf91
axios@1.13.2
1.18.0
1
fosrl/pangolin:1.13.0c32ad797ab96
axios@1.13.2
1.18.0
1
library/ghost:6.37.01ef2e532ca4d
axios@1.16.0
1.18.0
1
library/ghost:6.25.12654b1e90413
axios@1.13.2
1.18.0
1
library/ghost:6.41.129773d6be407
axios@1.16.0
1.18.0
1
library/ghost:6.39.0-alpine77196da4b0df
axios@1.16.0
1.18.0
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
axios@1.13.2
1.18.0
1
litlyx/litlyx-consumer:latest02225e77d316
axios@1.13.2
1.18.0
1
moreillon/group-manager:latest3caa8f710ee0
axios@1.15.0
1.18.0
1
n8nio/n8n:2.25.7761374d4eb84
axios@1.16.1
1.18.0
1
neoskop/ixy:2.1.125152b474f54
axios@1.16.0
1.18.0
1
nocodb/nocodb:0.301.5d9516f0bf546
axios@1.13.6
1.18.0
1
nodered/node-red:4.1.10-minimald73ae167cb9b
axios@1.16.0
1.18.0
1
oryd/kratos-selfservice-ui-node:v26.2.046a7bac1ad0c
axios@1.13.6
1.18.0
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
axios@1.13.2
1.18.0
1
redis/redisinsight:3.485562d67a912
axios@1.15.0
1.18.0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
axios@1.15.1
1.18.0
1
shyamkrishna21/shopsync:latest3998b83def53
axios@1.13.5
1.18.0
1
treskon/portrait-ui:DEV-lateste7970783bc8d
axios@1.15.2
1.18.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
axios@1.17.0
1.18.0
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
axios@1.13.6
1.18.0
1
unleashorg/unleash-server:7.5.09adb37e399ba
axios@1.13.5
1.18.0
1
veecode/devportalc443520aebf7
axios@1.16.1
1.18.0
1
ghcr.io/appscode/platform-ui:2.4.0668ee2682eaf
axios@1.15.0
1.18.0
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
axios@1.13.5
1.18.0
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
axios@1.13.2
1.18.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
axios@1.15.0
1.18.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
axios@1.16.0
1.18.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
axios@1.15.0
1.18.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
axios@1.13.6
1.18.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
axios@1.13.6
1.18.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.