StackRadar

CVE-2026-84363

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
41
of 17,781 indexed, latest versions
Container images
39
deployed by those charts
Fix available
1 of 1
affected package

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Carried by container images the latest versions of 41 of 17,781 indexed charts deploy, on 39 images.

Affected packageAffected versionsFixed inImages
hononpm4.6.12, 4.7.11, 4.10.4, 4.11.4+17 more4.13.539
OSV records
GHSA-crvj-82cr-hjcx

Charts affected

41 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
hono@4.12.34
4.13.5

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
hono@4.12.34
4.13.5

Open the chart page →

1,038
rocketchatrocketchat-server7.0.24 of 12See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.13.5
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.13.5
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.13.5
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.13.5

Open the chart page →

12,279
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
penpotapp/mcp:2.17.284f3f07ead11
hono@4.12.27
4.13.5

Open the chart page →

4,314
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.13.5

Open the chart page →

5,660
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
hono@4.12.34
4.13.5

Open the chart page →

863
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
hono@4.12.25
4.13.5

Open the chart page →

5,564
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
hono@4.12.32
4.13.5

Open the chart page →

9,460
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.13.5

Open the chart page →

7,146
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
hono@4.6.12
4.13.5

Open the chart page →

28,839
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
hono@4.12.18
4.13.5

Open the chart page →

1,447
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
hono@4.12.25
4.13.5

Open the chart page →

5,218
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.13.5

Open the chart page →

4,016
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.13.5

Open the chart page →

7,473
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.13.5

Open the chart page →

3,123
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.13.5

Open the chart page →

2,000
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.13.5

Open the chart page →

2,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.13.5

Open the chart page →

31,844
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
hono@4.7.11
4.13.5

Open the chart page →

5,213
crowdsec-web-uizekker6Verified publisher0.51.01 of 1See more

crowdsec-web-ui zekker6 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.8.3bfadbab9a72c
hono@4.12.27
4.13.5

Open the chart page →

1,411
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.13.5
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.13.5

Open the chart page →

3,600
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
hono@4.13.0
4.13.5

Open the chart page →

1,216
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.13.5

Open the chart page →

1,947
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
hono@4.13.1
4.13.5

Open the chart page →

1,138
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
hono@4.13.1
4.13.5

Open the chart page →

1,138
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
hono@4.13.1
4.13.5

Open the chart page →

1,138
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
hono@4.13.1
4.13.5

Open the chart page →

2,685
dial-admindialVerified publisher0.18.01 of 3See more

dial-admin dial 0.18.0

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.20.021d91ad74755
hono@4.13.0
4.13.5

Open the chart page →

4,046
bytestashhelmforgeVerified publisher1.0.01 of 1See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
hono@4.12.26
4.13.5

Open the chart page →

739
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
hono@4.12.18
4.13.5

Open the chart page →

2,463
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
hono@4.12.27
4.13.5

Open the chart page →

2,538
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
hono@4.13.2
4.13.5

Open the chart page →

2,061
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.13.5

Open the chart page →

1,498
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
hono@4.11.4
4.13.5

Open the chart page →

2,596
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.13.5

Open the chart page →

1,852
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.5

Open the chart page →

1,038
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.5

Open the chart page →

1,038
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.13.5

Open the chart page →

5,819
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
hono@4.10.4
4.13.5

Open the chart page →

4,684
its-mytabsstone0.3.01 of 1See more

its-mytabs stone 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
louislam/its-mytabs:1.7.02e478d3170bd
hono@4.13.1
4.13.5

Open the chart page →

1,477
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-84363.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.13.5

Open the chart page →

2,028

Container images carrying it

39 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latestf38d8571fa06
hono@4.13.1
4.13.5
4
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.13.5
2
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.5
2
n8nio/n8n:2.38.45d9f0cc5672b
hono@4.12.34
4.13.5
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.13.5
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.13.5
1
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.13.5
1
diygod/rsshub:2025-11-097a6312cac0d5
hono@4.10.4
4.13.5
1
docmost/docmost:0.95.041c8d777cf23
hono@4.12.25
4.13.5
1
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.13.5
1
epam/ai-dial-admin-frontend:0.20.021d91ad74755
hono@4.13.0
4.13.5
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.13.5
1
helmforge/strapi-base:5.52.270e9143d6d92
hono@4.13.2
4.13.5
1
library/ghost:6.62.0a7a268bbfb7f
hono@4.12.18
4.13.5
1
louislam/its-mytabs:1.7.02e478d3170bd
hono@4.13.1
4.13.5
1
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.13.5
1
n8nio/n8n:2.36.8cfe2704ff858
hono@4.12.34
4.13.5
1
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.13.5
1
outlinewiki/outline:1.10.1832051f039b4
hono@4.13.0
4.13.5
1
penpotapp/mcp:2.17.284f3f07ead11
hono@4.12.27
4.13.5
1
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.13.5
1
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.13.5
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.13.5
1
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.13.5
1
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.13.5
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.13.5
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.13.5
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.13.5
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
hono@4.12.26
4.13.5
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
hono@4.7.11
4.13.5
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
hono@4.12.32
4.13.5
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
hono@4.12.25
4.13.5
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.13.5
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
hono@4.12.27
4.13.5
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.13.5
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
hono@4.12.18
4.13.5
1
ghcr.io/theduffman85/crowdsec-web-ui:2026.8.3bfadbab9a72c
hono@4.12.27
4.13.5
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
hono@4.11.4
4.13.5
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
hono@4.6.12
4.13.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.