StackRadar

CVE-2026-71848

Medium

Advisory

Published 7 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
27
deployed by those charts
Fix available
1 of 1
affected package

Hono: Algorithmic Complexity DoS in Language Middleware

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 27 images.

Affected packageAffected versionsFixed inImages
hononpm4.12.3, 4.12.4, 4.12.5, 4.12.7+9 more4.12.3427
OSV records
GHSA-54fx-42gc-7vw4

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.0.24 of 12See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.12.34
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.12.34
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.12.34
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.12.34

Open the chart page →

12,279
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
penpotapp/mcp:2.17.284f3f07ead11
hono@4.12.27
4.12.34

Open the chart page →

4,314
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.12.34

Open the chart page →

5,660
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
hono@4.12.25
4.12.34

Open the chart page →

5,564
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
hono@4.12.32
4.12.34

Open the chart page →

9,460
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.12.34

Open the chart page →

7,146
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
hono@4.12.18
4.12.34

Open the chart page →

1,447
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
hono@4.12.25
4.12.34

Open the chart page →

5,218
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.12.34

Open the chart page →

4,016
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.12.34

Open the chart page →

7,473
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.12.34

Open the chart page →

3,123
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.12.34

Open the chart page →

2,000
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.12.34

Open the chart page →

2,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.12.34

Open the chart page →

31,844
crowdsec-web-uizekker6Verified publisher0.51.01 of 1See more

crowdsec-web-ui zekker6 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.8.3bfadbab9a72c
hono@4.12.27
4.12.34

Open the chart page →

1,411
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.12.34
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.12.34

Open the chart page →

3,600
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.12.34

Open the chart page →

1,947
bytestashhelmforgeVerified publisher1.0.01 of 1See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
hono@4.12.26
4.12.34

Open the chart page →

739
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
hono@4.12.18
4.12.34

Open the chart page →

2,463
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
hono@4.12.27
4.12.34

Open the chart page →

2,538
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.12.34

Open the chart page →

1,498
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.12.34

Open the chart page →

1,852
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.12.34

Open the chart page →

5,819
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-71848.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.12.34

Open the chart page →

2,028

Container images carrying it

27 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.12.34
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.12.34
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.12.34
1
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.12.34
1
docmost/docmost:0.95.041c8d777cf23
hono@4.12.25
4.12.34
1
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.12.34
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.12.34
1
library/ghost:6.62.0a7a268bbfb7f
hono@4.12.18
4.12.34
1
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.12.34
1
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.12.34
1
penpotapp/mcp:2.17.284f3f07ead11
hono@4.12.27
4.12.34
1
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.12.34
1
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.12.34
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.12.34
1
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.12.34
1
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.12.34
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.12.34
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.12.34
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.12.34
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
hono@4.12.26
4.12.34
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
hono@4.12.32
4.12.34
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
hono@4.12.25
4.12.34
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.12.34
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
hono@4.12.27
4.12.34
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.12.34
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
hono@4.12.18
4.12.34
1
ghcr.io/theduffman85/crowdsec-web-ui:2026.8.3bfadbab9a72c
hono@4.12.27
4.12.34
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.