StackRadar

CVE-2026-90771

Low

Advisory

Published 13 Sept 2026In the index since 6 Oct 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
99
of 18,026 indexed, latest versions
Container images
94
deployed by those charts
Fix available
1 of 1
affected package

joi messages compilation allows prototype replacement through __proto__ error codes

Carried by container images the latest versions of 99 of 18,026 indexed charts deploy, on 94 images.

Affected packageAffected versionsFixed inImages
joinpm6.10.1, 10.0.6, 10.6.0, 11.4.0+25 more17.13.8, 18.2.994
OSV records
GHSA-wr44-6hxh-3jwq

Charts affected

99 by stars
ChartLatestAffected imagesRadar Score
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
joi@18.2.8
18.2.9

Open the chart page →

312
unleashunleash5.6.81 of 2See more

unleash unleash 5.6.8

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
unleashorg/unleash-server:7.5.09adb37e399ba
joi@18.0.2
18.2.9

Open the chart page →

2,330
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
joi@14.3.1
17.13.8

Open the chart page →

13,536
budibasebudibase0.0.0-master2 of 7See more

budibase budibase 0.0.0-master

2 of the 7 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
joi@18.2.1
18.2.9
budibase/worker:3.41.3de5e2e560ce8
joi@18.2.1
18.2.9

Open the chart page →

11,836
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
joi@10.6.0
17.13.8

Open the chart page →

37,595
uptime-kumaduyet0.1.81 of 1See more

uptime-kuma duyet 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
joi@14.3.1
17.13.8

Open the chart page →

5,691
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
joi@17.9.2
17.13.8

Open the chart page →

3,398
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
joi@14.3.1
17.13.8

Open the chart page →

7,861
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
joi@14.3.1
17.13.8

Open the chart page →

12,012
kubebadgeskubebadges0.1.31 of 2See more

kubebadges kubebadges 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
shieldsio/shields:next1c094cffc61b
joi@18.2.5
18.2.9

Open the chart page →

2,175
kubeviouskubevious1.2.24 of 7See more

kubevious kubevious 1.2.2

4 of the 7 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
joi@17.9.2
17.13.8
kubevious/collector:1.2.1f58226f9d84e
joi@17.9.2
17.13.8
kubevious/guard:1.2.19bf567704de2
joi@17.6.0
17.13.8
kubevious/parser:1.2.299ae7a5168c2
joi@17.9.2
17.13.8

Open the chart page →

17,557
mstreamnicholaswildeVerified publisher2.1.21 of 1See more

mstream nicholaswilde 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/mstream:version-v5.2.522c012bcc43c
joi@17.4.2
17.13.8

Open the chart page →

5,643
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
joi@17.4.2
17.13.8

Open the chart page →

102,426
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
joi@13.7.0
17.13.8

Open the chart page →

20,196
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
joi@13.7.0
17.13.8

Open the chart page →

12,246
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
joi@14.3.1
17.13.8

Open the chart page →

2,045
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
joi@18.0.1
18.2.9

Open the chart page →

9,353
globalpingglobalpingVerified publisher1.0.111 of 1See more

globalping globalping 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
globalping/globalping-probe:latestb8469caf783a
joi@17.13.3
17.13.8

Open the chart page →

683
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
joi@14.3.1
17.13.8

Open the chart page →

5,249
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
joi@17.4.0
17.13.8

Open the chart page →

18,226
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
joi@18.1.2
18.2.9

Open the chart page →

6,430
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
joi@17.4.0
17.13.8

Open the chart page →

7,375
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
joi@17.13.3
17.13.8

Open the chart page →

3,389
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
joi@17.13.3
17.13.8

Open the chart page →

3,744
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
joi@17.6.0
17.13.8

Open the chart page →

2,719
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
joi@17.6.0
17.13.8

Open the chart page →

2,763
smartorchestratorassist-iot-smart-orchestrator4.0.03 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

3 of the 14 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
joi@17.6.0
17.13.8
assistiot/smart-orchestrator_enabler:latest89f37e88c871
joi@17.6.0
17.13.8
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
joi@17.6.0
17.13.8

Open the chart page →

51,061
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
joi@13.7.0
17.13.8

Open the chart page →

6,098
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
joi@11.4.0
17.13.8

Open the chart page →

26,458
codiac-cluster-agent-chartcodiac-cluster-agent1.0.381 of 1See more

codiac-cluster-agent-chart codiac-cluster-agent 1.0.38

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
codiacimages/codiac-cluster-agent:1.0.380cd44ca7a7ee
joi@18.0.2
18.2.9

Open the chart page →

1,884
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
joi@17.13.3
17.13.8

Open the chart page →

4,127
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
joi@13.7.0
17.13.8

Open the chart page →

15,804
decisionrules-aksdecisionrules-aksVerified publisher0.3.01 of 2See more

decisionrules-aks decisionrules-aks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
joi@17.13.7
17.13.8

Open the chart page →

458
decisionrules-eksdecisionrules-eksVerified publisher0.4.01 of 2See more

decisionrules-eks decisionrules-eks 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
joi@17.13.7
17.13.8

Open the chart page →

458
decisionrules-ingressdecisionrules-ingressVerified publisher0.3.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
joi@17.13.7
17.13.8

Open the chart page →

458
decisionrules-ocpdecisionrules-ocpVerified publisher0.2.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
joi@17.13.7
17.13.8

Open the chart page →

1,506
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
joi@17.13.3
17.13.8

Open the chart page →

5,437
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
joi@14.3.1
17.13.8

Open the chart page →

5,270
exposrexposr0.12.01 of 1See more

exposr exposr 0.12.0

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
ghcr.io/exposr/exposrd:v0.12.0561c8f23bdb6
joi@17.6.0
17.13.8

Open the chart page →

596
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
joi@17.13.6
17.13.8

Open the chart page →

2,431
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
louislam/uptime-kuma:170233f4acb51
joi@14.3.1
17.13.8

Open the chart page →

4,360
uptime-kumafmjstudios0.2.21 of 1See more

uptime-kuma fmjstudios 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
joi@14.3.1
17.13.8

Open the chart page →

5,249
uptime-kumafossa1.0.11 of 1See more

uptime-kuma fossa 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
joi@14.3.1
17.13.8

Open the chart page →

6,568
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
joi@13.7.0
17.13.8

Open the chart page →

4,251
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
joi@17.7.1
17.13.8

Open the chart page →

37,657
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
joi@6.10.1
17.13.8
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
joi@6.10.1
17.13.8
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
joi@6.10.1
17.13.8
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
joi@6.10.1
17.13.8

Open the chart page →

91,741
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
joi@17.11.0
17.13.8

Open the chart page →

4,082
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
joi@6.10.1
17.13.8

Open the chart page →

119,072
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
joi@10.0.6
17.13.8

Open the chart page →

6,249
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-90771.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
joi@6.10.1
17.13.8

Open the chart page →

6,924

Container images carrying it

94 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/event-sidecar:v11.0.189b8ab71b74b
joi@13.7.0
17.13.8
5
decisionrules/server:latestbb3a93224b5a
joi@17.13.7
17.13.8
4
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
joi@17.4.2
17.13.8
3
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
joi@18.2.8
18.2.9
3
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
joi@13.7.0
17.13.8
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
joi@17.13.1
17.13.8
2
library/arangodb:3.11.81e75d74954a4
joi@14.3.1
17.13.8
2
louislam/uptime-kuma:1.23.1396510915e6be
joi@14.3.1
17.13.8
2
migmartri/prerender:latest486aacfd5aa9
joi@10.0.6
17.13.8
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
joi@17.4.0
17.13.8
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
joi@17.4.0
17.13.8
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
joi@17.13.3
17.13.8
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
joi@17.13.3
17.13.8
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
joi@17.12.0
17.13.8
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
joi@18.0.1
18.2.9
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
joi@17.7.0
17.13.8
2
opensearchproject/opensearch-dashboards:1.0.039695180364b
joi@13.7.0
17.13.8
2
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
joi@13.7.0
17.13.8
1
apimap/developer:v1.3.1406d3858e20c
joi@17.6.0
17.13.8
1
apimap/portal:v2.4.0041a4790c65c
joi@17.6.0
17.13.8
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
joi@13.7.0
17.13.8
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
joi@13.7.0
17.13.8
1
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
joi@17.6.0
17.13.8
1
assistiot/smart-orchestrator_enabler:latest89f37e88c871
joi@17.6.0
17.13.8
1
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
joi@17.6.0
17.13.8
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
joi@17.4.2
17.13.8
1
budibase/apps:3.41.344fe6feab985
joi@18.2.1
18.2.9
1
budibase/worker:3.41.3de5e2e560ce8
joi@18.2.1
18.2.9
1
codiacimages/codiac-cluster-agent:1.0.380cd44ca7a7ee
joi@18.0.2
18.2.9
1
cryptexlabs/authf:0.12.11189c07411d7c
joi@17.13.3
17.13.8
1
denisshav/backend:latest4cc8dc5a4499
joi@14.3.1
17.13.8
1
directus/directus:12.0.29c8470ea465c
joi@18.0.1
18.2.9
1
directus/directus:11.1.0e3c8bb975350
joi@17.13.3
17.13.8
1
fallenbagel/jellyseerr:latest4538137bc5af
joi@17.13.3
17.13.8
1
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
joi@17.13.3
17.13.8
1
getwud/wud:8.1.1b1cd01c43839
joi@17.13.3
17.13.8
1
globalping/globalping-probe:latestb8469caf783a
joi@17.13.3
17.13.8
1
heywood8/redisinsight:2.28.00bc9ab313d37
joi@17.9.2
17.13.8
1
ibmcom/microclimate-portal:latested5505e5c7ec
joi@6.10.1
17.13.8
1
jayfong/yapi:1.10.2163e5d621910
joi@6.10.1
17.13.8
1
joplin/server:3.0-beta52af57880c0e
joi@17.11.0
17.13.8
1
kubevious/backend:1.2.22d9ba6eb46b6
joi@17.9.2
17.13.8
1
kubevious/collector:1.2.1f58226f9d84e
joi@17.9.2
17.13.8
1
kubevious/guard:1.2.19bf567704de2
joi@17.6.0
17.13.8
1
kubevious/parser:1.0.151acf1a1f0b47
joi@17.4.1
17.13.8
1
kubevious/parser:1.2.299ae7a5168c2
joi@17.9.2
17.13.8
1
kubevious/workload-operator:1.0.20b0f4c507eb6
joi@17.9.1
17.13.8
1
library/kibana:7.17.150172f1c538e7
joi@17.7.1
17.13.8
1
library/kibana:7.9.1b1bbcaa57738
joi@13.7.0
17.13.8
1
library/kibana:7.17.8c5781ba340ef
joi@17.4.0
17.13.8
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.