StackRadar

CVE-2026-84428

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
42
of 18,026 indexed, latest versions
Container images
43
deployed by those charts
Fix available
1 of 1
affected package

fastify vulnerable to header validation bypass via incomplete schema case normalization

Carried by container images the latest versions of 42 of 18,026 indexed charts deploy, on 43 images.

Affected packageAffected versionsFixed inImages
fastifynpm3.15.1, 3.20.1, 3.24.1, 3.28.0+14 more5.12.243
OSV records
GHSA-9q9j-q6p8-xq58

Charts affected

42 by stars
ChartLatestAffected imagesRadar Score
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
fastify@4.29.1
5.12.2

Open the chart page →

8,704
supabasetokens-studioVerified publisher1.0.02 of 14See more

supabase tokens-studio 1.0.0

2 of the 14 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.84.2d0a96973e9f1
fastify@4.26.2
5.12.2
supabase/storage-api:v1.12.0f983fb50bd95
fastify@4.28.1
5.12.2

Open the chart page →

26,010
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
fastify@5.3.3
5.12.2

Open the chart page →

1,612
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fastify@4.28.1
5.12.2

Open the chart page →

34,276
activepiecesmeyerchartsVerified publisher0.1.61 of 1See more

activepieces meyercharts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
activepieces/activepieces:0.23.0c26188b44e62
fastify@4.12.0
5.12.2

Open the chart page →

3,450
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latest413a0c813e96
fastify@5.8.5
5.12.2

Open the chart page →

8,934
bredbandskollen-prometheus-exporteraolde0.2.31 of 1See more

bredbandskollen-prometheus-exporter aolde 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
aolde/bredbandskollen-prometheus-exporter:1.0.2dc61ee713720
fastify@3.15.1
5.12.2

Open the chart page →

2,457
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
fastify@3.28.0
5.12.2

Open the chart page →

88,299
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
chibisafe/chibisafe-server:latest3da4fcbc1a18
fastify@4.26.2
5.12.2

Open the chart page →

5,701
psa-restricted-patcherpsa-restricted-patcherVerified publisher0.10.11 of 1See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
fastify@4.29.1
5.12.2

Open the chart page →

1,637
supabasesupabse0.8.02 of 11See more

supabase supabse 0.8.0

2 of the 11 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.96.6a84cc713585e
fastify@4.29.1
5.12.2
supabase/storage-api:v1.60.4c8eb9858eafe
fastify@5.8.5
5.12.2

Open the chart page →

21,495
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
fastify@5.8.5
5.12.2

Open the chart page →

3,223
trifidzazukoOfficialVerified publisher0.2.11 of 1See more

trifid zazuko 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
fastify@5.8.5
5.12.2

Open the chart page →

614
activepiecesadnoctemVerified publisher0.6.01 of 1See more

activepieces adnoctem 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
activepieces/activepieces:0.91.058414dfc94c4
fastify@5.8.5
5.12.2

Open the chart page →

1,893
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest8aa1c158d885
fastify@5.12.1
5.12.2

Open the chart page →

837
lametric-nightscout-proxyaolde0.1.01 of 1See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
fastify@4.8.1
5.12.2

Open the chart page →

1,427
openmctbryopsida0.1.11 of 1See more

openmct bryopsida 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/openmct:main38b6a50a62b2
fastify@5.11.2
5.12.2

Open the chart page →

1,489
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
fastify@3.20.1
5.12.2

Open the chart page →

4,127
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
fastify@5.8.5
5.12.2

Open the chart page →

2,741
krci-portalepmdedpVerified publisher0.8.01 of 1See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
fastify@5.8.5
5.12.2

Open the chart page →

1,036
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
chainsafe/lodestar:latestc13eac6aada7
fastify@5.12.1
5.12.2

Open the chart page →

3,164
activepiecesfmjstudios0.2.31 of 1See more

activepieces fmjstudios 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
activepieces/activepieces:0.28.0a12efde0c535
fastify@4.12.0
5.12.2

Open the chart page →

3,856
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
fastify@4.28.1
5.12.2

Open the chart page →

3,456
homebridgehomeenterpriseinc0.5.01 of 1See more

homebridge homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
oznu/homebridge:2021-12-19-ubuntu2e12d0e2dcce
fastify@3.24.1
5.12.2

Open the chart page →

81,331
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
infisical/infisical:latest3365445909be
fastify@5.8.5
5.12.2

Open the chart page →

3,361
homebridgejespernohrVerified publisher0.2.01 of 1See more

homebridge jespernohr 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
homebridge/homebridge:latest22cdfca31934
fastify@5.12.1
5.12.2

Open the chart page →

37,060
k8s-jacoco-operatork8s-jacoco-operator0.4.01 of 4See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
fastify@4.26.2
5.12.2

Open the chart page →

2,994
k8s-mutating-webhookk8s-mutating-webhook0.3.01 of 2See more

k8s-mutating-webhook k8s-mutating-webhook 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-mutating-webhook:mainaaab005242ae
fastify@4.26.2
5.12.2

Open the chart page →

2,530
k8s-validating-webhookk8s-validating-webhook0.4.01 of 2See more

k8s-validating-webhook k8s-validating-webhook 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-validating-webhook:main8344061b2f22
fastify@4.26.2
5.12.2

Open the chart page →

2,530
kube-admission-controller-starterk8s-validating-webhook0.2.01 of 2See more

kube-admission-controller-starter k8s-validating-webhook 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
fastify@4.5.3
5.12.2

Open the chart page →

2,680
homebridgelbenicio-communityVerified publisher0.1.151 of 1See more

homebridge lbenicio-community 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
homebridge/homebridge:latest22cdfca31934
fastify@5.12.1
5.12.2

Open the chart page →

37,060
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
fastify@5.8.5
5.12.2
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
fastify@5.8.5
5.12.2

Open the chart page →

3,882
docker-mailservermailserverVerified publisher0.2.651 of 9See more

docker-mailserver mailserver 0.2.65

1 of the 9 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/jeboehm/fetchmailmgr:0.3.2126c4691b28a4
fastify@5.3.3
5.12.2

Open the chart page →

13,747
mongo-compassmongo-compass-webVerified publisher1.1.41 of 1See more

mongo-compass mongo-compass-web 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
haohanyang/compass-web:0.5.1f4f8fe4e21f1
fastify@5.12.1
5.12.2

Open the chart page →

2,189
mongo-compassmongo-compass-web-helm1.1.01 of 1See more

mongo-compass mongo-compass-web-helm 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
haohanyang/compass-web:0.5.054f2112602ee
fastify@5.8.5
5.12.2

Open the chart page →

2,859
ixyneoskop2.2.01 of 1See more

ixy neoskop 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
neoskop/ixy:2.2.015a480e34778
fastify@5.11.3
5.12.2

Open the chart page →

478
walletconnect-relayparadeum-teamVerified publisher0.1.21 of 1See more

walletconnect-relay paradeum-team 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
fastify@4.2.1
5.12.2

Open the chart page →

1,415
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fastify@5.8.5
5.12.2

Open the chart page →

8,250
infisicalsinextraVerified publisher0.6.11 of 1See more

infisical sinextra 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.166b911e3938ac
fastify@5.8.5
5.12.2

Open the chart page →

3,361
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
fastify@5.0.0
5.12.2

Open the chart page →

4,942
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
supabase/storage-api:latest5fea789899d4
fastify@5.11.2
5.12.2

Open the chart page →

10,655
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-84428.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
fastify@5.8.4
5.12.2

Open the chart page →

2,706

Container images carrying it

43 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
epamedp/krci-portal:0.8.0687acf641097
fastify@5.8.5
5.12.2
2
homebridge/homebridge:latest22cdfca31934
fastify@5.12.1
5.12.2
2
activepieces/activepieces:0.91.058414dfc94c4
fastify@5.8.5
5.12.2
1
activepieces/activepieces:0.28.0a12efde0c535
fastify@4.12.0
5.12.2
1
activepieces/activepieces:0.23.0c26188b44e62
fastify@4.12.0
5.12.2
1
aolde/bredbandskollen-prometheus-exporter:1.0.2dc61ee713720
fastify@3.15.1
5.12.2
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
fastify@5.0.0
5.12.2
1
chainsafe/lodestar:latestc13eac6aada7
fastify@5.12.1
5.12.2
1
chibisafe/chibisafe-server:latest3da4fcbc1a18
fastify@4.26.2
5.12.2
1
contane/foreman:0.5.2efb98bdcc4e9
fastify@5.3.3
5.12.2
1
cryptexlabs/authf:0.12.11189c07411d7c
fastify@3.20.1
5.12.2
1
ducktors/turborepo-remote-cache:latest8aa1c158d885
fastify@5.12.1
5.12.2
1
haohanyang/compass-web:0.5.054f2112602ee
fastify@5.8.5
5.12.2
1
haohanyang/compass-web:0.5.1f4f8fe4e21f1
fastify@5.12.1
5.12.2
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
fastify@4.29.1
5.12.2
1
infisical/infisical:latest3365445909be
fastify@5.8.5
5.12.2
1
infisical/infisical:v0.165.166b911e3938ac
fastify@5.8.5
5.12.2
1
journeyapps/powersync-service:latest413a0c813e96
fastify@5.8.5
5.12.2
1
neoskop/ixy:2.2.015a480e34778
fastify@5.11.3
5.12.2
1
oznu/homebridge:2021-12-19-ubuntu2e12d0e2dcce
fastify@3.24.1
5.12.2
1
qxip/qryn:3.2.3977acc9c7a9fd
fastify@4.28.1
5.12.2
1
supabase/postgres-meta:v0.96.6a84cc713585e
fastify@4.29.1
5.12.2
1
supabase/postgres-meta:v0.84.2d0a96973e9f1
fastify@4.26.2
5.12.2
1
supabase/storage-api:latest5fea789899d4
fastify@5.11.2
5.12.2
1
supabase/storage-api:v1.60.4c8eb9858eafe
fastify@5.8.5
5.12.2
1
supabase/storage-api:v1.12.0f983fb50bd95
fastify@4.28.1
5.12.2
1
tenureai/tenure:v1.0.285f5b222df9a5
fastify@5.8.5
5.12.2
1
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
fastify@4.8.1
5.12.2
1
ghcr.io/bryopsida/openmct:main38b6a50a62b2
fastify@5.11.2
5.12.2
1
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
fastify@4.29.1
5.12.2
1
ghcr.io/colanode/server:latest7006cac874fd
fastify@5.8.4
5.12.2
1
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
fastify@4.26.2
5.12.2
1
ghcr.io/curium-rocks/k8s-mutating-webhook:mainaaab005242ae
fastify@4.26.2
5.12.2
1
ghcr.io/curium-rocks/k8s-validating-webhook:main8344061b2f22
fastify@4.26.2
5.12.2
1
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
fastify@4.5.3
5.12.2
1
ghcr.io/jeboehm/fetchmailmgr:0.3.2126c4691b28a4
fastify@5.3.3
5.12.2
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
fastify@5.8.5
5.12.2
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
fastify@5.8.5
5.12.2
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
fastify@3.28.0
5.12.2
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fastify@5.8.5
5.12.2
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fastify@4.28.1
5.12.2
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
fastify@5.8.5
5.12.2
1
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
fastify@4.2.1
5.12.2
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.