StackRadarChart IndexLive demo

GHSA-j8px-rmrx-76h9

Medium

Advisory

Published 18 Sept 2026In the index since 24 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 29; of 17,911 indexed, latest versions
Container images: 25; deployed by those charts
Fix available: 1 of 1; affected package

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Carried by container images the latest versions of 29 of 17,911 indexed charts deploy, on 25 images.

Affected package	Affected versions	Fixed in	Images
github.com/caddyserver/caddy/v2golang	v2.2.0, v2.4.0, v2.4.2, v2.4.5+13 more	2.11.4	25

OSV records: GHSA-j8px-rmrx-76h9
Also known as: CVE-2026-77281, CVE-2026-92284, CVE-2026-92700

Charts affected

29 by stars

Chart

Latest

Affected images

Radar Score

baserowbaserow-chart

1 of 6 See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4

Open the chart page →

18,373

caddy-ingress-controllercaddy-ingress

1 of 1 See more

caddy-ingress-controller caddy-ingress 1.3.0

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4

Open the chart page →

1,919

convertigoconvertigo

1 of 5 See more

convertigo convertigo 8.4.4

1 of the 5 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
baserow/baserow :1.30.1	df0c42eb67e8	github.com/caddyserver/caddy/v2@v2.7.6	2.11.4

Open the chart page →

15,645

kubeviouskubevious

1 of 7 See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
kubevious/ui :1.2.1	6233e84bdd59	github.com/caddyserver/caddy/v2@v2.6.1	2.11.4

Open the chart page →

14,417

wordpress-hardenedriotkit-org

1 of 2 See more

wordpress-hardened riotkit-org 2.0.0

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/riotkit-org/waf-proxy :snapshot	683656fdace2	github.com/caddyserver/caddy/v2@v2.5.1	2.11.4

Open the chart page →

6,645

maintenancecodewithemad

1 of 1 See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
library/caddy :2.9-alpine	b4e3952384eb	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4

Open the chart page →

1,531

gboxgbox

1 of 2 See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
gboxproxy/gbox :v1.0.6	3a9f4a711d5c	github.com/caddyserver/caddy/v2@v2.5.0	2.11.4

Open the chart page →

2,557

headscale-uiheadscale-ui

1 of 1 See more

headscale-ui headscale-ui 0.2.9

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/gurucomputing/headscale-ui :2026.03.17	015f5ba04bcb	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

1,554

kubebrowsekubebrowse

1 of 5 See more

kubebrowse kubebrowse 1.7.0

1 of the 5 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/browsersec/kubebrowse-frontend :chore-improve-back	bd6bea5e487c	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

2,998

wordpress-helmwordpress-helm

1 of 4 See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4

Open the chart page →

8,945

baserowblackbird-cloud

1 of 6 See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4

Open the chart page →

10,616

caddycaddy

1 of 1 See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
library/caddy :2.11.2-alpine	834468128c76	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4

Open the chart page →

1,731

mercurecloudnativeapp

1 of 1 See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
dunglas/mercure :v0	916834e49961	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4

Open the chart page →

1,154

parrot-mirroremmas-charts

1 of 1 See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4

Open the chart page →

2,278

supportpalevilgn0me

1 of 1 See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	github.com/caddyserver/caddy/v2@v2.5.1	2.11.4

Open the chart page →

21,488

fluxer-helmfluxer-helm

1 of 18 See more

fluxer-helm fluxer-helm 0.3.0

1 of the 18 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/fluxerapp/fluxer-static :2026.812.125337	cfe98ae544df	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

29,126

searxgeek-cookbook

1 of 4 See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
library/caddy :2.2.0-alpine	7367adca165f	github.com/caddyserver/caddy/v2@v2.2.0	2.11.4

Open the chart page →

7,534

vikunjageek-cookbook

1 of 4 See more

vikunja geek-cookbook 6.2.0

1 of the 4 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
library/caddy :2.4.2-alpine	fbc51bcf1ab0	github.com/caddyserver/caddy/v2@v2.4.2	2.11.4

Open the chart page →

6,923

castopodhelmforge

1 of 3 See more

castopod helmforge 1.2.8

1 of the 3 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
castopod/castopod :1.15.5	4e4f0440520f	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

9,863

discount-bandithelmforge

1 of 3 See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
cybrarist/discount-bandit :v4.0.4	e9e2447ac666	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4

Open the chart page →

31,715

pimcorehelmforge

1 of 6 See more

pimcore helmforge 2.0.2

1 of the 6 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
dunglas/mercure :v0.24.2	916834e49961	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4

Open the chart page →

3,119

ryothelmforge

1 of 2 See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4

Open the chart page →

5,934

op-scim-bridgelifen

1 of 2 See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	github.com/caddyserver/caddy/v2@v2.4.0	2.11.4

Open the chart page →

2,798

op-scim-bridgelifen-charts

1 of 2 See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	github.com/caddyserver/caddy/v2@v2.4.0	2.11.4

Open the chart page →

2,798

otlp-gatewayloafoe

1 of 2 See more

otlp-gateway loafoe 0.0.2

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	github.com/caddyserver/caddy/v2@v2.8.4	2.11.4

Open the chart page →

2,222

1 of 1 See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4

Open the chart page →

2,144

gitlab-proxyopslevel

1 of 1 See more

gitlab-proxy opslevel 0.0.8

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
library/caddy :2.6	60fb54d36b4b	github.com/caddyserver/caddy/v2@v2.6.4	2.11.4

Open the chart page →

1,909

caddysagikazarmark

1 of 1 See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
library/caddy :2.4.5	874405536b3e	github.com/caddyserver/caddy/v2@v2.4.5	2.11.4

Open the chart page →

2,992

tfy-cloudflaredtruefoundry

1 of 2 See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry GHSA-j8px-rmrx-76h9.

Container image	Digest	Package	Fixed in
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	github.com/caddyserver/caddy/v2@v2.6.3	2.11.4

Open the chart page →

2,052

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
caddy/ingress :v0.2.1	18d1366fc0e9	github.com/caddyserver/caddy/v2@v2.7.5	2.11.4	3
1password/scim :v2.3.1	29d0c6cb67eb	github.com/caddyserver/caddy/v2@v2.4.0	2.11.4	2
dunglas/mercure :v0 :v0.24.2	916834e49961	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4	2
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	github.com/caddyserver/caddy/v2@v2.11.3	2.11.4	1
baserow/baserow :1.30.1	df0c42eb67e8	github.com/caddyserver/caddy/v2@v2.7.6	2.11.4	1
castopod/castopod :1.15.5	4e4f0440520f	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
cybrarist/discount-bandit :v4.0.4	e9e2447ac666	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
gboxproxy/gbox :v1.0.6	3a9f4a711d5c	github.com/caddyserver/caddy/v2@v2.5.0	2.11.4	1
kubevious/ui :1.2.1	6233e84bdd59	github.com/caddyserver/caddy/v2@v2.6.1	2.11.4	1
library/caddy :2.6	60fb54d36b4b	github.com/caddyserver/caddy/v2@v2.6.4	2.11.4	1
library/caddy :2.2.0-alpine	7367adca165f	github.com/caddyserver/caddy/v2@v2.2.0	2.11.4	1
library/caddy :2.11.2-alpine	834468128c76	github.com/caddyserver/caddy/v2@v2.11.2	2.11.4	1
library/caddy :2.4.5	874405536b3e	github.com/caddyserver/caddy/v2@v2.4.5	2.11.4	1
library/caddy :2.9-alpine	b4e3952384eb	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4	1
library/caddy :2.4.2-alpine	fbc51bcf1ab0	github.com/caddyserver/caddy/v2@v2.4.2	2.11.4	1
ghcr.io/browsersec/kubebrowse-frontend :chore-improve-back	bd6bea5e487c	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
ghcr.io/fluxerapp/fluxer-static :2026.812.125337	cfe98ae544df	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
ghcr.io/gurucomputing/headscale-ui :2026.03.17	015f5ba04bcb	github.com/caddyserver/caddy/v2@v2.10.2	2.11.4	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	github.com/caddyserver/caddy/v2@v2.9.1	2.11.4	1
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	github.com/caddyserver/caddy/v2@v2.8.4	2.11.4	1
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4	1
ghcr.io/riotkit-org/waf-proxy :snapshot	683656fdace2	github.com/caddyserver/caddy/v2@v2.5.1	2.11.4	1
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	github.com/caddyserver/caddy/v2@v2.6.3	2.11.4	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	github.com/caddyserver/caddy/v2@v2.5.1	2.11.4	1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	github.com/caddyserver/caddy/v2@v2.7.4	2.11.4	1