StackRadar

CVE-2026-77078

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
141
of 17,781 indexed, latest versions
Container images
138
deployed by those charts
Fix available
1 of 1
affected package

multer vulnerable to Denial of Service via crafted multipart field names

Carried by container images the latest versions of 141 of 17,781 indexed charts deploy, on 138 images.

Affected packageAffected versionsFixed inImages
multernpm0.1.8, 1.3.0, 1.4.1, 1.4.2+9 more2.3.0138
OSV records
GHSA-wc9g-mqfw-jrwm

Charts affected

141 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
multer@2.2.0
2.3.0

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
multer@2.2.0
2.3.0

Open the chart page →

1,038
node-rednode-redVerified publisher0.40.21 of 1See more

node-red node-red 0.40.2

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
nodered/node-red:4.1.2216e7403aab9
multer@2.0.2
2.3.0

Open the chart page →

2,172
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
multer@2.1.1
2.3.0

Open the chart page →

3,004
velero-uiotwldVerified publisher0.15.01 of 1See more

velero-ui otwld 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
otwld/velero-ui:0.10.2d1954b759e47
multer@2.2.0
2.3.0

Open the chart page →

1,332
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
multer@1.4.5-lts.1
2.3.0

Open the chart page →

5,639
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
multer@2.2.0
2.3.0

Open the chart page →

863
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
multer@1.4.4-lts.1
2.3.0

Open the chart page →

2,828
redisinsightredisinsight-guiVerified publisher1.3.51 of 1See more

redisinsight redisinsight-gui 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
redis/redisinsight:3.8b5e19ee240ab
multer@2.0.2
2.3.0

Open the chart page →

1,038
redisinsight-secureredisinsight-secureVerified publisher1.0.21 of 1See more

redisinsight-secure redisinsight-secure 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
redis/redisinsight:2.68019fcf774631
multer@1.4.4-lts.1
2.3.0

Open the chart page →

1,721
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
multer@2.2.0
2.3.0

Open the chart page →

1,339
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
multer@1.4.5-lts.1
2.3.0

Open the chart page →

14,238
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
multer@1.4.4
2.3.0

Open the chart page →

5,251
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
multer@1.4.2
2.3.0

Open the chart page →

5,946
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
multer@1.4.5-lts.1
2.3.0

Open the chart page →

2,654
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
multer@2.2.0
2.3.0

Open the chart page →

7,146
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
multer@1.4.4-lts.1
2.3.0

Open the chart page →

3,451
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
multer@2.2.0
2.3.0

Open the chart page →

1,447
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
multer@1.4.5-lts.2
2.3.0

Open the chart page →

2,003
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
multer@1.4.5-lts.1
2.3.0

Open the chart page →

7,776
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
multer@1.4.5-lts.1
2.3.0

Open the chart page →

2,702
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
multer@1.4.3
2.3.0

Open the chart page →

24,488
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
multer@2.0.2
2.3.0

Open the chart page →

4,016
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
multer@1.4.5-lts.1
2.3.0

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
multer@1.4.5-lts.1
2.3.0

Open the chart page →

77,687
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
multer@2.1.1
2.3.0

Open the chart page →

1,991
data-fairdata354-helmVerified publisher1.1.23 of 12See more

data-fair data354-helm 1.1.2

3 of the 12 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
multer@1.4.4
2.3.0
ghcr.io/data-fair/portals:18b621866ceb2
multer@1.4.4
2.3.0
ghcr.io/data-fair/simple-directory:438a4f32fad82
multer@1.4.4
2.3.0

Open the chart page →

38,346
jellystatdjjudas21Verified publisher0.1.121 of 1See more

jellystat djjudas21 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
multer@1.4.5-lts.2
2.3.0

Open the chart page →

1,722
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
multer@2.1.1
2.3.0
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
multer@2.1.1
2.3.0

Open the chart page →

31,510
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
multer@1.4.5-lts.1
2.3.0

Open the chart page →

11,458
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
multer@1.4.4
2.3.0

Open the chart page →

4,260
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
multer@1.4.2
2.3.0

Open the chart page →

3,444
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
multer@1.4.2
2.3.0

Open the chart page →

4,410
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
multer@2.1.1
2.3.0

Open the chart page →

3,123
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
multer@2.2.0
2.3.0

Open the chart page →

2,000
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
multer@2.0.2
2.3.0

Open the chart page →

15,712
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
multer@1.4.4
2.3.0

Open the chart page →

13,738
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
multer@2.1.1
2.3.0

Open the chart page →

2,575
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
multer@1.4.4-lts.1
2.3.0

Open the chart page →

2,473
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
multer@2.0.1
2.3.0

Open the chart page →

2,083
pdf-editor-helmpdf-editor-web1.0.01 of 4See more

pdf-editor-helm pdf-editor-web 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
multer@1.4.5-lts.1
2.3.0

Open the chart page →

4,206
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
multer@2.1.1
2.3.0

Open the chart page →

7,035
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
multer@1.4.3
2.3.0

Open the chart page →

2,449
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
multer@2.1.1
2.3.0

Open the chart page →

5,482
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
multer@1.4.5-lts.1
2.3.0

Open the chart page →

2,823
immichsecustorVerified publisher2.0.41 of 1See more

immich secustor 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
multer@2.2.0
2.3.0

Open the chart page →

3,059
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
multer@2.0.2
2.3.0

Open the chart page →

4,010
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
multer@1.4.4
2.3.0

Open the chart page →

3,833
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
multer@1.4.5-lts.1
2.3.0

Open the chart page →

9,783
excalidashalekcVerified publisher1.4.01 of 2See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-77078.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
multer@2.2.0
2.3.0

Open the chart page →

904

Container images carrying it

138 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
redis/redisinsight:3.8:latestb5e19ee240ab
multer@2.0.2
2.3.0
4
assistiot/dlt_api:2.0.0e36a8922fa0c
multer@1.4.5-lts.1
2.3.0
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
multer@2.1.1
2.3.0
3
governify/director:v1.4.0608c6940bb98
multer@1.4.3
2.3.0
2
governify/registry:v3.4.0d3f37f4f8168
multer@1.4.2
2.3.0
2
governify/reporter:v2.2.038595913458f
multer@1.4.2
2.3.0
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
multer@1.4.4-lts.1
2.3.0
2
library/ghost:6.63.0e05bc1169fb2
multer@2.2.0
2.3.0
2
n8nio/n8n:2.36.714c4285bc303
multer@2.2.0
2.3.0
2
n8nio/n8n:2.38.45d9f0cc5672b
multer@2.2.0
2.3.0
2
redis/redis-stack:7.2.0-v91c5f43fddcdd
multer@1.4.4-lts.1
2.3.0
2
requarks/wiki:2:latest68f0d1848261
multer@1.4.4
2.3.0
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
multer@1.4.5-lts.1
2.3.0
2
anamskenneth/recipe_backend:2025-06-079b7d2cd389b7
multer@1.4.5-lts.1
2.3.0
1
assistiot/dlt_api:2.1.0c8a170683be7
multer@1.4.5-lts.1
2.3.0
1
automatischio/automatisch:0.15.03bace7a12d5f
multer@1.4.5-lts.1
2.3.0
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
multer@1.4.4-lts.1
2.3.0
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
multer@1.4.3
2.3.0
1
chocobozzz/peertube:v8.1.5052712130691
multer@2.1.1
2.3.0
1
cryptexlabs/authf:0.12.11189c07411d7c
multer@1.4.4-lts.1
2.3.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
multer@1.4.5-lts.2
2.3.0
1
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
multer@1.4.5-lts.1
2.3.0
1
evoapicloud/evolution-api:latest966625532d90
multer@2.0.2
2.3.0
1
fallenbagel/jellyseerr:latest4538137bc5af
multer@1.4.5-lts.1
2.3.0
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
multer@1.4.5-lts.1
2.3.0
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
multer@2.0.1
2.3.0
1
fiware/idm:8.3.3a1b6ed4ae84f
multer@1.4.4
2.3.0
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
multer@2.1.1
2.3.0
1
glenndehaan/api-mapper:latest6ff6310683bf
multer@1.4.5-lts.1
2.3.0
1
glenndehaan/contentbridge:latest99b9e4f73848
multer@1.4.5-lts.1
2.3.0
1
governify/collector-dynamic:v1.3.06d3d1a5b46a9
multer@1.4.2
2.3.0
1
heywood8/redisinsight:2.28.00bc9ab313d37
multer@1.4.4-lts.1
2.3.0
1
hhaluk/crypto-watchdog:0.4.0a6555953d941
multer@1.4.2
2.3.0
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
multer@1.4.4-lts.1
2.3.0
1
hoppscotch/hoppscotch:2026.8.0d50725df661f
multer@2.2.0
2.3.0
1
ibmcom/bai-admin-dev:19.0.202d882f2836e
multer@1.4.1
2.3.0
1
jakowenko/double-take:1.6.0b858bac9e32a
multer@1.4.3
2.3.0
1
jayfong/yapi:1.10.2163e5d621910
multer@1.3.0
2.3.0
1
kubebb/bff-server:v0.2.0-202312040fbb732379bc
multer@1.4.4-lts.1
2.3.0
1
kubebb/component-store:latestfd8ecbd73213
multer@1.4.4-lts.1
2.3.0
1
library/ghost:6.37.01ef2e532ca4d
multer@2.1.1
2.3.0
1
library/ghost:6.25.12654b1e90413
multer@2.1.1
2.3.0
1
library/ghost:6.41.129773d6be407
multer@2.1.1
2.3.0
1
library/ghost:4.37.0767230c0f263
multer@1.4.4
2.3.0
1
library/ghost:6.39.0-alpine77196da4b0df
multer@2.1.1
2.3.0
1
library/ghost:5.79.083f7bf209844
multer@1.4.4
2.3.0
1
library/ghost:6.62.0a7a268bbfb7f
multer@2.2.0
2.3.0
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
multer@2.1.1
2.3.0
1
linuxserver/overseerr:1.35.06108ed066d4a
multer@1.4.5-lts.1
2.3.0
1
lukasreining/open-api-schema-collector:0.1.050e021c42e33
multer@1.4.4-lts.1
2.3.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.