StackRadarChart IndexLive demo

CVE-2026-84368

Low

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026

Severity: Low; worst across findings
CVSS: 3.7; base score, highest
EPSS: 0.003; 17th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 63; of 17,781 indexed, latest versions
Container images: 58; deployed by those charts
Fix available: 1 of 2; affected packages

joi: Prototype pollution via a `__proto__` language key in custom messages

Carried by container images the latest versions of 63 of 17,781 indexed charts deploy, on 58 images.

Affected package	Affected versions	Fixed in	Images
joinpm	17.4.0, 17.4.1, 17.4.2, 17.6.0+15 more	17.13.6, 18.2.5	54
@hapi/joinpm	16.1.8, 17.1.1	no fix listed	8

OSV records: GHSA-6w3j-5fw6-r9vr

Charts affected

63 by stars

Chart

Latest

Affected images

Radar Score

security-role-perm-operator-svcmojaloop

1 of 1 See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	joi@18.0.1	18.2.5

Open the chart page →

2,457

user-manager-mongodbmoreillon

1 of 4 See more

user-manager-mongodb moreillon 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
moreillon/user-manager-mongoose :v5.0.1	d2ee0423b797	joi@17.11.0	17.13.6

Open the chart page →

25,704

user-manager-neo4jmoreillon

1 of 6 See more

user-manager-neo4j moreillon 0.9.7

1 of the 6 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
moreillon/user-manager :v5.0.2	e1c9bfab5c16	joi@17.7.0	17.13.6

Open the chart page →

30,363

papergirlneoskop

1 of 5 See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
neoskop/papergirl :3.2.6	7f52b5949f03	joi@17.12.0	17.13.6

Open the chart page →

6,982

relfinder-reformedrelfinderreformed

1 of 2 See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
ghcr.io/woodenmaiden/relfinderreformedapi :1.1.2	0708d30433d4	joi@17.11.0	17.13.6

Open the chart page →

6,282

joplinrubxkube

1 of 2 See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
joplin/server :3.0-beta	52af57880c0e	joi@17.11.0	17.13.6

Open the chart page →

7,413

safe-stacksafe-global

1 of 9 See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
gjeanmart/safe-ganache-node :latest	926264c8f2d1	joi@17.13.1	17.13.6

Open the chart page →

19,560

safe-transaction-servicesafe-global

1 of 6 See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
gjeanmart/safe-ganache-node :latest	926264c8f2d1	joi@17.13.1	17.13.6

Open the chart page →

16,620

unleash-enterpriseunleash

1 of 1 See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	joi@18.0.2	18.2.5

Open the chart page →

2,028

simple-prima-notavcnngr

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
vcnngr/pnbackend :latest	eaf44ad0ad1f	joi@17.13.3	17.13.6

Open the chart page →

4,768

browserlessvictorlane

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	joi@18.0.2	18.2.5

Open the chart page →

4,305

opensearch-dashboardswenerme

1 of 1 See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :3.8.0	ca28e40a095f	joi@18.2.1	18.2.5

Open the chart page →

280

kibanawiremind

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-84368.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	joi@17.13.3	17.13.6

Open the chart page →

6,285

Container images carrying it

58 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/data-fair/simple-directory :4	38a4f32fad82	@hapi/joi@16.1.8	no fix listed	1
ghcr.io/exposr/exposrd :v0.12.0	561c8f23bdb6	joi@17.6.0	17.13.6	1
ghcr.io/fallenbagel/jellyseerr :2.5.2	2a611369ad1d	joi@17.13.3	17.13.6	1
ghcr.io/huscker/townsquare-backend :2.15.2	e106681e7673	joi@17.11.0	17.13.6	1
ghcr.io/middleware-labs/odigos-odiglet :middleware-test-0.0.1	03c8c835ecee	joi@17.8.3	17.13.6	1
ghcr.io/middleware-labs/vision-odiglet :middleware-test-0.0.3	bce34c98668e	joi@17.8.4	17.13.6	1
ghcr.io/seerr-team/seerr :v3.2.0	c4cbd5121236	joi@17.13.3	17.13.6	1
ghcr.io/woodenmaiden/relfinderreformedapi :1.1.2	0708d30433d4	joi@17.11.0	17.13.6	1