StackRadar

CVE-2026-9679

Medium

Advisory

Published 17 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
163
of 17,781 indexed, latest versions
Container images
150
deployed by those charts
Fix available
3 of 4
affected packages

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Carried by container images the latest versions of 163 of 17,781 indexed charts deploy, on 150 images.

Affected packageAffected versionsFixed inImages
undicinpm4.15.0, 5.6.0, 5.11.0, 5.12.0+38 more6.27.0, 7.28.0, 8.5.0150
node-undicideb5.26.3+dfsg1+~cs23.10.12-2, 7.3.0+dfsg1+~cs24.12.11-1no fix listed2
node-gypapk13.0.0-r013.0.0-r11
npmapk11.17.0-r011.17.0-r11
OSV records
CGA-5mx2-gq8r-3v7qCGA-gvrp-v4p2-65f2DEBIAN-CVE-2026-9679GHSA-p88m-4jfj-68fvUBUNTU-CVE-2026-9679
Also known as
CGA-86v8-3h7f-7vw6, CGA-j25g-hhpp-x3wr

Charts affected

163 by stars
ChartLatestAffected imagesRadar Score
penpotpenpotOfficialVerified publisher1.9.02 of 4See more

penpot penpot 1.9.0

2 of the 4 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
penpotapp/exporter:2.17.272a8061e8806
undici@6.26.0
6.27.0
penpotapp/mcp:2.17.284f3f07ead11
undici@6.26.0
6.27.0

Open the chart page →

4,314
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
undici@6.26.0
6.27.0

Open the chart page →

7,210
apisix-ingress-controllerapisix1.3.11 of 2See more

apisix-ingress-controller apisix 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
undici@6.25.0
6.27.0

Open the chart page →

1,616
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
undici@6.25.0
6.27.0

Open the chart page →

9,203
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
undici@6.21.2
6.27.0

Open the chart page →

8,364
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
undici@8.3.0
8.5.0

Open the chart page →

5,660
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
undici@6.25.0
6.27.0

Open the chart page →

3,004
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
undici@6.21.3
6.27.0

Open the chart page →

10,775
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
undici@6.9.0
6.27.0

Open the chart page →

5,639
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
undici@6.26.0
6.27.0

Open the chart page →

2,977
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.27.0

Open the chart page →

2,938
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
openmined/syft-frontend:0.9.5d11524a3854a
undici@6.11.1
6.27.0

Open the chart page →

17,245
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
undici@6.26.0
6.27.0

Open the chart page →

1,339
dialdialOfficialVerified publisher7.2.01 of 4See more

dial dial 7.2.0

1 of the 4 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
epam/ai-dial-chat:0.49.0bd6b13695cdc
undici@6.26.0
6.27.0

Open the chart page →

2,163
foundry-vttfoundry-vttVerified publisher12.343.01 of 1See more

foundry-vtt foundry-vtt 12.343.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
felddy/foundryvtt:12.343.06c5e3e9ffbb0
undici@6.19.7
6.27.0

Open the chart page →

723
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
undici@6.26.0
6.27.0

Open the chart page →

9,460
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
node-undici@7.3.0+dfsg1+~cs24.12.11-1
undici@7.3.0
no fix listed
7.28.0

Open the chart page →

3,641
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
undici@6.21.0
6.27.0

Open the chart page →

7,949
wg-easywg-easyVerified publisher0.1.61 of 1See more

wg-easy wg-easy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:150e7bc9d34e86
undici@6.26.0
6.27.0

Open the chart page →

725
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
undici@5.28.4
6.27.0

Open the chart page →

28,839
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
undici@6.26.0
6.27.0

Open the chart page →

1,870
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.27.0

Open the chart page →

10,311
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
undici@6.25.0
6.27.0

Open the chart page →

1,304
kubebadgeskubebadges0.1.31 of 2See more

kubebadges kubebadges 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
shieldsio/shields:nextfa194b446e42
undici@6.26.0
6.27.0

Open the chart page →

1,798
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
undici@6.25.0
6.27.0

Open the chart page →

5,218
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.27.0

Open the chart page →

977
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latestbf46f66e5dcc
undici@6.26.0
6.27.0

Open the chart page →

8,491
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
undici@7.24.4
7.28.0

Open the chart page →

4,016
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
undici@6.26.0
6.27.0

Open the chart page →

1,044
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
undici@6.26.0
6.27.0

Open the chart page →

5,880
kinesisaws-kinesis-local0.8.01 of 1See more

kinesis aws-kinesis-local 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
saidsef/aws-kinesis-local:v2026.0667025e3a163e
undici@6.26.0
6.27.0

Open the chart page →

360
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
undici@6.25.0
6.27.0

Open the chart page →

1,991
home-assistant-matter-servercharts-derwitt-devVerified publisher4.2.11 of 2See more

home-assistant-matter-server charts-derwitt-dev 4.2.1

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/matter-js/matterjs-server:1.4.054232d0d3e7d
undici@6.26.0
6.27.0

Open the chart page →

2,360
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
undici@7.24.5
7.28.0

Open the chart page →

7,473
jellystatdjjudas21Verified publisher0.1.121 of 1See more

jellystat djjudas21 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
undici@6.26.0
6.27.0

Open the chart page →

1,722
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
undici@7.24.4
7.28.0

Open the chart page →

3,123
globalpingglobalpingVerified publisher1.0.111 of 1See more

globalping globalping 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
globalping/globalping-probe:latest8acbd23009fd
undici@5.29.0
6.27.0

Open the chart page →

518
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
undici@6.21.1
6.27.0

Open the chart page →

5,228
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
undici@6.26.0
6.27.0

Open the chart page →

1,322
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
undici@5.15.0
6.27.0

Open the chart page →

20,403
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
undici@7.24.6
7.28.0

Open the chart page →

2,575
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
undici@6.21.2
6.27.0

Open the chart page →

6,873
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
undici@6.22.0
6.27.0

Open the chart page →

6,883
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
undici@6.24.1
6.27.0

Open the chart page →

7,035
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
undici@6.25.0
6.27.0

Open the chart page →

5,482
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
undici@7.3.0
7.28.0

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
undici@6.22.0
6.27.0

Open the chart page →

38,107
immichsecustorVerified publisher2.0.41 of 1See more

immich secustor 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
undici@6.26.0
6.27.0

Open the chart page →

3,059
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
undici@6.21.3
6.27.0

Open the chart page →

5,213
wg-easyslybase-wg-easyVerified publisher1.2.01 of 1See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-9679.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:15.4.00e7bc9d34e86
undici@6.26.0
6.27.0

Open the chart page →

725

Container images carrying it

150 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
undici@5.12.0
6.27.0
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
undici@6.25.0
6.27.0
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
undici@6.26.0
6.27.0
3
ethersphere/bee-localchain:latest0558799ca992
undici@5.28.3
6.27.0
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
undici@5.28.4
6.27.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
undici@6.25.0
6.27.0
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
undici@7.11.0
7.28.0
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
undici@7.10.0
7.28.0
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
undici@7.16.0
7.28.0
2
rajnandan1/kener:3.2.1930407afca731
undici@6.21.1
6.27.0
2
requarks/wiki:2:latest68f0d1848261
undici@6.25.0
6.27.0
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
undici@6.26.0
6.27.0
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
undici@5.22.0
6.27.0
2
ghcr.io/api7/adc:0.27.1f65f53dd9668
undici@6.25.0
6.27.0
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
undici@6.26.0
6.27.0
2
aaronshaf/dynamodb-admin:latestac41724cd997
undici@6.25.0
6.27.0
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
undici@7.24.1
7.28.0
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
undici@5.28.3
6.27.0
1
archivebox/archivebox:0.7.41a5a37331091
undici@6.25.0
6.27.0
1
budibase/apps:3.41.344fe6feab985
undici@6.21.3
6.27.0
1
catalysm/csmm:latestf003b35f54d9
undici@5.29.0
6.27.0
1
chatwoot/chatwoot:v4.15.167ebc751c171
undici@6.25.0
6.27.0
1
chocobozzz/peertube:v8.1.5052712130691
undici@6.24.1
6.27.0
1
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
undici@6.26.0
6.27.0
1
cryptexlabs/authf:0.12.11189c07411d7c
undici@6.19.8
6.27.0
1
cspconsole/report-processor:1.0.279a2d8840bfdf
undici@5.29.0
6.27.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
undici@6.26.0
6.27.0
1
deconzcommunity/deconz:2.29.2062de2362641
undici@5.15.0
6.27.0
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
undici@6.26.0
6.27.0
1
directus/directus:12.0.29c8470ea465c
undici@7.24.5
7.28.0
1
directus/directus:11.1.0e3c8bb975350
undici@6.19.5
6.27.0
1
diygod/rsshub:2025-11-097a6312cac0d5
undici@6.22.0
6.27.0
1
drumsergio/lynxprompt:2.0.75c6afb6679301
undici@6.25.0
6.27.0
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
undici@6.24.1
6.27.0
1
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
undici@6.26.0
6.27.0
1
epam/ai-dial-admin-frontend:0.20.021d91ad74755
undici@6.26.0
6.27.0
1
epam/ai-dial-chat:0.49.0bd6b13695cdc
undici@6.26.0
6.27.0
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
undici@4.15.0
6.27.0
1
etherpad/etherpad:2.7.2b723fe5f2594
undici@7.25.0
7.28.0
1
ethpandaops/assertoor:latest1efa2fba6711
undici@6.26.0
6.27.0
1
evoapicloud/evolution-api:latest966625532d90
undici@7.16.0
7.28.0
1
fallenbagel/jellyseerr:latest4538137bc5af
undici@7.3.0
7.28.0
1
felddy/foundryvtt:12.343.06c5e3e9ffbb0
undici@6.19.7
6.27.0
1
fosrl/pangolin:latest83a55f933b4d
undici@6.26.0
6.27.0
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
undici@7.24.4
7.28.0
1
globalping/globalping-probe:latest8acbd23009fd
undici@5.29.0
6.27.0
1
haohanyang/compass-web:0.5.054f2112602ee
undici@6.25.0
6.27.0
1
helmforge/opencut:v0.3.0bf11156e0ab5
undici@6.26.0
6.27.0
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
undici@6.21.2
6.27.0
1
journeyapps/powersync-service:latestbf46f66e5dcc
undici@6.26.0
6.27.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.