StackRadar

CVE-2026-71498

Medium

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.1
base score, highest
EPSS
0.002
13th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,781 indexed, latest versions
Container images
22
deployed by those charts
Fix available
1 of 1
affected package

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
re2npm1.15.4, 1.16.0, 1.17.3, 1.17.4+8 more1.26.122
OSV records
GHSA-j4r3-hg7j-8chg

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
re2@1.17.4
1.26.1

Open the chart page →

5,251
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
re2@1.23.3
1.26.1

Open the chart page →

9,460
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
re2@1.15.4
1.26.1

Open the chart page →

17,896
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
re2@1.15.4
1.26.1

Open the chart page →

10,730
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
re2@1.17.3
1.26.1

Open the chart page →

4,260
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
re2@1.16.0
1.26.1

Open the chart page →

17,284
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
re2@1.16.0
1.26.1

Open the chart page →

6,879
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
re2@1.22.1
1.26.1

Open the chart page →

5,213
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
re2@1.15.4
1.26.1

Open the chart page →

5,806
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
re2@1.21.3
1.26.1

Open the chart page →

4,083
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
re2@1.17.4
1.26.1

Open the chart page →

13,852
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
re2@1.20.1
1.26.1

Open the chart page →

34,754
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
re2@1.20.3
1.26.1

Open the chart page →

9,019
gtmgtmVerified publisher1.0.21 of 1See more

gtm gtm 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
re2@1.24.1
1.26.1

Open the chart page →

472
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
re2@1.24.0
1.26.1

Open the chart page →

3,014
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
re2@1.23.3
1.26.1

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
re2@1.23.3
1.26.1

Open the chart page →

3,092
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
re2@1.23.3
1.26.1

Open the chart page →

2,756
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
re2@1.15.4
1.26.1

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
re2@1.15.4
1.26.1

Open the chart page →

10,603
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
re2@1.21.3
1.26.1

Open the chart page →

4,960
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
re2@1.22.3
1.26.1

Open the chart page →

3,270
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
re2@1.22.1
1.26.1

Open the chart page →

5,338
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
re2@1.24.0
1.26.1

Open the chart page →

3,014
gtm-server-container-clustertrieb-work0.1.81 of 1See more

gtm-server-container-cluster trieb-work 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
re2@1.24.1
1.26.1

Open the chart page →

472
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-71498.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
re2@1.15.4
1.26.1

Open the chart page →

5,806

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
re2@1.15.4
1.26.1
2
infisical/infisical:latest:v0.165.602082bf13163
re2@1.24.0
1.26.1
2
opensearchproject/opensearch-dashboards:1.0.039695180364b
re2@1.15.4
1.26.1
2
gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable688d35c6c544
re2@1.24.1
1.26.1
2
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
re2@1.15.4
1.26.1
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
re2@1.15.4
1.26.1
1
library/ghost:6.37.01ef2e532ca4d
re2@1.23.3
1.26.1
1
library/ghost:6.25.12654b1e90413
re2@1.21.3
1.26.1
1
library/ghost:6.41.129773d6be407
re2@1.23.3
1.26.1
1
library/ghost:4.37.0767230c0f263
re2@1.17.3
1.26.1
1
library/ghost:6.39.0-alpine77196da4b0df
re2@1.23.3
1.26.1
1
library/ghost:5.79.083f7bf209844
re2@1.20.3
1.26.1
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
re2@1.21.3
1.26.1
1
library/kibana:7.17.150172f1c538e7
re2@1.20.1
1.26.1
1
library/kibana:7.17.8c5781ba340ef
re2@1.16.0
1.26.1
1
library/kibana:7.17.3e2e2031c15be
re2@1.16.0
1.26.1
1
misskey/misskey:12.110.1e08b7c478093
re2@1.17.4
1.26.1
1
wazuh/wazuh-dashboard:4.4.11787550d2358
re2@1.17.4
1.26.1
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
re2@1.22.1
1.26.1
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
re2@1.23.3
1.26.1
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
re2@1.22.1
1.26.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
re2@1.22.3
1.26.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.