StackRadar

CVE-2026-75899

High

Advisory

Published 24 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.002
12th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
68
of 17,781 indexed, latest versions
Container images
65
deployed by those charts
Fix available
1 of 2
affected packages

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 65 images.

Affected packageAffected versionsFixed inImages
fast-urinpm3.1.2, 3.1.3, 3.1.4, 3.1.5+2 more3.1.6, 4.1.362
node-ajvdeb6.10.2-1, 8.12.0~ds+~2.1.1-4no fix listed3
OSV records
GHSA-fph4-wmhf-6fwfUBUNTU-CVE-2026-75899

Charts affected

68 by stars
ChartLatestAffected imagesRadar Score
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
fast-uri@3.1.2
3.1.6

Open the chart page →

1,809
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
fast-uri@3.1.2
3.1.6
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
fast-uri@3.1.2
3.1.6

Open the chart page →

2,774
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
node-ajv@6.10.2-1
no fix listed

Open the chart page →

17,779
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
fast-uri@3.1.2
3.1.6

Open the chart page →

1,852
mongo-compassmongo-compass-web-helm1.1.01 of 1See more

mongo-compass mongo-compass-web-helm 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
haohanyang/compass-web:0.5.054f2112602ee
fast-uri@3.1.2
3.1.6

Open the chart page →

2,396
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
fast-uri@3.1.5
3.1.6

Open the chart page →

1,038
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
fast-uri@3.1.2
3.1.6

Open the chart page →

3,798
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
fast-uri@3.1.5
3.1.6

Open the chart page →

1,038
portalplatform-mesh-portal0.19.41 of 1See more

portal platform-mesh-portal 0.19.4

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
ghcr.io/platform-mesh/portal:v0.26.123c937255cac2
fast-uri@3.1.5
3.1.6

Open the chart page →

301
prismeai-coreprismeai1.12.12 of 7See more

prismeai-core prismeai 1.12.1

2 of the 7 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod470da8f8730c
fast-uri@3.1.5
3.1.6
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
fast-uri@3.1.5
3.1.6

Open the chart page →

3,270
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
fast-uri@3.1.4
3.1.6

Open the chart page →

895
web-checkrm3lVerified publisher0.1.01 of 1See more

web-check rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
fast-uri@3.1.4
3.1.6

Open the chart page →

9,047
your-spotifyrubxkubeVerified publisher1.0.11 of 3See more

your-spotify rubxkube 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
yooooomi/your_spotify_client:1.20.0e4da90a0634c
fast-uri@3.1.2
3.1.6

Open the chart page →

5,066
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
node-ajv@6.10.2-1
no fix listed

Open the chart page →

10,902
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
fast-uri@3.1.2
3.1.6

Open the chart page →

3,972
supabaseteochenglim0.1.22 of 13See more

supabase teochenglim 0.1.2

2 of the 13 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
supabase/storage-api:latestf6c42a04163d
fast-uri@4.1.1
4.1.3
supabase/studio:latest94a2a9d2906e
fast-uri@3.1.5
3.1.6

Open the chart page →

9,556
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
fast-uri@3.1.2
3.1.6

Open the chart page →

1,787
opensearch-dashboardswenerme3.8.01 of 1See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-75899.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.0ca28e40a095f
fast-uri@3.1.2
3.1.6

Open the chart page →

280

Container images carrying it

65 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
fast-uri@3.1.3
3.1.6
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
fast-uri@3.1.2
3.1.6
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
fast-uri@3.1.2
3.1.6
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
fast-uri@3.1.2
3.1.6
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
fast-uri@3.1.2
3.1.6
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
fast-uri@3.1.2
3.1.6
1
ghcr.io/platform-mesh/portal:v0.26.123c937255cac2
fast-uri@3.1.5
3.1.6
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
fast-uri@3.1.2
3.1.6
1
ghcr.io/umami-software/umami:3.3.1fa32d116cf20
fast-uri@3.1.5
3.1.6
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
fast-uri@3.1.2
3.1.6
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
fast-uri@3.1.3
3.1.6
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
fast-uri@3.1.3
3.1.6
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
fast-uri@3.1.2
3.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod470da8f8730c
fast-uri@3.1.5
3.1.6
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
fast-uri@3.1.5
3.1.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.