StackRadar

GHSA-5r4p-p66f-jhc7

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
37
of 18,208 indexed, latest versions
Container images
39
deployed by those charts
Fix available
1 of 1
affected package

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Carried by container images the latest versions of 37 of 18,208 indexed charts deploy, on 39 images.

Affected packageAffected versionsFixed inImages
hononpm4.12.4, 4.12.5, 4.12.7, 4.12.8+15 more4.13.1139
OSV records
GHSA-5r4p-p66f-jhc7
Also known as
CVE-2026-109955, CVE-2026-111757

Charts affected

37 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.431 of 1See more

n8n community-charts 1.24.43

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.687e0bab2c931
hono@4.12.34
4.13.11

Open the chart page →

1,634
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
hono@4.12.34
4.13.11

Open the chart page →

2,510
backstagebackstageOfficialVerified publisher2.10.21 of 1See more

backstage backstage 2.10.2

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/backstage/backstage:latest68f2025a3f27
hono@4.13.8
4.13.11

Open the chart page →

1,362
rocketchatrocketchat-server7.0.24 of 12See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.13.11
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.13.11
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.13.11
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.13.11

Open the chart page →

17,033
penpotpenpotOfficialVerified publisher1.11.32 of 5See more

penpot penpot 1.11.3

2 of the 5 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
penpotapp/admin-console:2.18.35935b5adbf33
hono@4.13.8
4.13.11
penpotapp/mcp:2.18.35e811e6eeb17
hono@4.13.5
4.13.11

Open the chart page →

6,129
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.13.11

Open the chart page →

6,685
n8nhelmforgeVerified publisher2.1.81 of 2See more

n8n helmforge 2.1.8

1 of the 2 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.44.4c72fa9f1bd9b
hono@4.12.34
4.13.11

Open the chart page →

1,079
docmosthelmforgeVerified publisher1.4.41 of 4See more

docmost helmforge 1.4.4

1 of the 4 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
docmost/docmost:0.96.0b56947fcfd08
hono@4.12.34
4.13.11

Open the chart page →

4,668
karakeephelmforgeVerified publisher1.2.111 of 3See more

karakeep helmforge 1.2.11

1 of the 3 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.34.0151cdd6b5f2e
hono@4.13.8
4.13.11

Open the chart page →

10,864
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.13.11

Open the chart page →

5,618
agentareaagentareaVerified publisher0.0.281 of 17See more

agentarea agentarea 0.0.28

1 of the 17 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-base:0.1.18b80f30570ff
hono@4.13.9
4.13.11

Open the chart page →

12,172
betterdb-monitorbetterdb-monitorOfficialVerified publisher0.49.01 of 1See more

betterdb-monitor betterdb-monitor 0.49.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
betterdb/monitor:0.49.0-no-ai97dcd2d2192f
hono@4.13.1
4.13.11

Open the chart page →

683
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.13.11

Open the chart page →

9,890
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.13.11

Open the chart page →

3,670
n8nklicktippVerified publisher1.11.11 of 1See more

n8n klicktipp 1.11.1

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.43.3d4eca183959b
hono@4.12.34
4.13.11

Open the chart page →

1,634
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.13.11

Open the chart page →

4,286
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.13.11

Open the chart page →

37,593
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.13.11
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.13.11

Open the chart page →

4,435
outlineadnoctemVerified publisher0.1.31 of 1See more

outline adnoctem 0.1.3

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
outlinewiki/outline:1.11.008ee9ffdb847
hono@4.13.7
4.13.11

Open the chart page →

1,578
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.13.11

Open the chart page →

2,282
decisionrules-aksdecisionrules-aksOfficialVerified publisher0.3.01 of 2See more

decisionrules-aks decisionrules-aks 0.3.0

1 of the 2 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
decisionrules/server:latest6f6d024a87b8
hono@4.13.7
4.13.11

Open the chart page →

404
decisionrules-eksdecisionrules-eksOfficialVerified publisher0.4.01 of 2See more

decisionrules-eks decisionrules-eks 0.4.0

1 of the 2 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
decisionrules/server:latest6f6d024a87b8
hono@4.13.7
4.13.11

Open the chart page →

404
decisionrules-ingressdecisionrules-ingressOfficialVerified publisher0.3.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.3.0

1 of the 2 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
decisionrules/server:latest6f6d024a87b8
hono@4.13.7
4.13.11

Open the chart page →

404
decisionrules-ocpdecisionrules-ocpOfficialVerified publisher0.2.11 of 4See more

decisionrules-ocp decisionrules-ocp 0.2.1

1 of the 4 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
hono@4.13.7
4.13.11

Open the chart page →

1,877
dial-admindialVerified publisher0.20.01 of 3See more

dial-admin dial 0.20.0

1 of the 3 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.22.07bceacad3de2
hono@4.13.7
4.13.11

Open the chart page →

3,687
ghostfoliohelmforgeVerified publisher1.1.21 of 4See more

ghostfolio helmforge 1.1.2

1 of the 4 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.88.0256c524a6116
hono@4.12.14
4.13.11

Open the chart page →

5,092
paprahelmforgeVerified publisher1.0.21 of 1See more

papra helmforge 1.0.2

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.7.0-rootlessbf4a66e776d0
hono@4.13.5
4.13.11

Open the chart page →

3,638
reactive-resumehelmforgeVerified publisher1.0.21 of 4See more

reactive-resume helmforge 1.0.2

1 of the 4 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
hono@4.13.7
4.13.11

Open the chart page →

3,964
strapihelmforgeVerified publisher2.3.171 of 3See more

strapi helmforge 2.3.17

1 of the 3 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.25a6c2c449840
hono@4.13.2
4.13.11

Open the chart page →

2,574
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
nocodb/nocodb:latest27d2fd14670d
hono@4.13.7
4.13.11

Open the chart page →

352
api-key-managerjtektVerified publisher0.3.01 of 4See more

api-key-manager jtekt 0.3.0

1 of the 4 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/api-key-manager-api:v0.1.175a48d987e0f
hono@4.12.21
4.13.11

Open the chart page →

7,897
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.13.11

Open the chart page →

2,007
mcp-kubernetesmcp-helmVerified publisher0.2.71 of 1See more

mcp-kubernetes mcp-helm 0.2.7

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
mcp/kubernetes:latest5ffbf7f0a8aa
hono@4.12.28
4.13.11

Open the chart page →

7,177
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.11

Open the chart page →

2,510
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.11

Open the chart page →

2,510
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.13.11

Open the chart page →

9,114
its-mytabsstone0.3.01 of 1See more

its-mytabs stone 0.3.0

1 of the 1 container images this version deploys carry GHSA-5r4p-p66f-jhc7.

Container imageDigestPackageFixed in
louislam/its-mytabs:1.7.02e478d3170bd
hono@4.13.1
4.13.11

Open the chart page →

2,259

Container images carrying it

39 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latest6f6d024a87b8
hono@4.13.7
4.13.11
3
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.11
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.13.11
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.13.11
1
agentarea/agentarea-mcp-base:0.1.1:latest8b80f30570ff
hono@4.13.9
4.13.11
1
betterdb/monitor:0.49.0-no-ai97dcd2d2192f
hono@4.13.1
4.13.11
1
decisionrules/server:latestbb3a93224b5a
hono@4.13.7
4.13.11
1
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.13.11
1
docmost/docmost:0.96.0b56947fcfd08
hono@4.12.34
4.13.11
1
epam/ai-dial-admin-frontend:0.22.07bceacad3de2
hono@4.13.7
4.13.11
1
ghostfolio/ghostfolio:3.88.0256c524a6116
hono@4.12.14
4.13.11
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.13.11
1
helmforge/strapi-base:5.52.25a6c2c449840
hono@4.13.2
4.13.11
1
louislam/its-mytabs:1.7.02e478d3170bd
hono@4.13.1
4.13.11
1
mcp/kubernetes:latest5ffbf7f0a8aa
hono@4.12.28
4.13.11
1
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.13.11
1
n8nio/n8n:2.41.687e0bab2c931
hono@4.12.34
4.13.11
1
n8nio/n8n:2.44.4c72fa9f1bd9b
hono@4.12.34
4.13.11
1
n8nio/n8n:2.36.8cfe2704ff858
hono@4.12.34
4.13.11
1
n8nio/n8n:2.43.3d4eca183959b
hono@4.12.34
4.13.11
1
nocodb/nocodb:latest27d2fd14670d
hono@4.13.7
4.13.11
1
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.13.11
1
outlinewiki/outline:1.11.008ee9ffdb847
hono@4.13.7
4.13.11
1
penpotapp/admin-console:2.18.0:2.18.1:2.18.2:2.18.35935b5adbf33
hono@4.13.8
4.13.11
1
penpotapp/mcp:2.18.35e811e6eeb17
hono@4.13.5
4.13.11
1
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.13.11
1
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.13.11
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.13.11
1
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.13.11
1
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.13.11
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
hono@4.13.7
4.13.11
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.13.11
1
ghcr.io/backstage/backstage:latest68f2025a3f27
hono@4.13.8
4.13.11
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.13.11
1
ghcr.io/karakeep-app/karakeep:0.34.0151cdd6b5f2e
hono@4.13.8
4.13.11
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.13.11
1
ghcr.io/papra-hq/papra:26.7.0-rootlessbf4a66e776d0
hono@4.13.5
4.13.11
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.13.11
1
public.ecr.aws/jtekt-corporation/api-key-manager-api:v0.1.175a48d987e0f
hono@4.12.21
4.13.11
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.