mastodon 0.0.18

Chart · Apps & productivity · standard · v0.0.18

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Mastodon, the federated social network server (web and sidekiq). Built from the release tag on a hardened Wolfi ruby-4.0 runtime with every gem compiled from source against Wolfi's libvips, libpq, ICU and libxml2, and the web assets compiled at build time, so no Node ships at runtime. Nonroot, read-only rootfs; PostgreSQL and Redis are external. The streaming server is a separate image.

Version

0.0.19 · latest 0.0.18 0.0.17

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Released version

This is the 0.0.18 release of the mastodon chart, published 2026-10-22. For the live security report and the currently deployed image digest, see the latest release.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Security report (Trivy)

D· 29/1008 fixable · rebuild clears them

Vulnerability detail

mastodon 4.7.3 · 8 CVE

CVE	Severity	Package	Installed	Fixed in	Title
GHSA-5v64-555j-wjxm	HIGH	rack	3.2.7	~> 2.2.25, ~> 3.1.23, >= 3.2.8	Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
CVE-2026-116695	MEDIUM	crass	1.0.7	1.0.8	crass: crass: CSS injection via malformed URL token parsing
GHSA-2j8w-xcrc-x985	MEDIUM	rack	3.2.7	~> 3.1.23, >= 3.2.8	Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass
GHSA-5287-hmjh-qmqq	MEDIUM	pghero	4.0.1	>= 4.1.0	Insecure direct object reference (IDOR)
GHSA-wvg4-6p58-3gh3	MEDIUM	rack	3.2.7	~> 2.2.25, ~> 3.1.23, >= 3.2.8	Rack::Static `header_rules` bypass via unnormalized dot segments in the request path
GHSA-p8x9-v4hv-2w4g	LOW	rack	3.2.7	~> 2.2.25, ~> 3.1.23, >= 3.2.8	Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass
GHSA-pq4g-8rxf-4g29	UNKNOWN	crass	1.0.7	>= 1.0.8	Incorrect tokenization of bad URLs enables CSS sanitizer bypass
GHSA-wgw9-qhqg-8hv5	UNKNOWN	sanitize	7.0.0	>= 7.0.1	CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets

Critical

High

Medium

Low

Unknown

Security report (Trivy) · image mastodon 4.7.3

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (pinned to 0.0.18)

helm install my-mastodon oci://ghcr.io/quenchworks/charts/mastodon --version 0.0.18

Chart version: 0.0.18
Chart license: AGPL-3.0-only
App license: AGPL-3.0
Service port: 3000
Signed: cosign (keyless)
Released: 2026-10-22

Verify the chart

cosign verify ghcr.io/quenchworks/charts/mastodon:0.0.18 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the image View on ArtifactHub Chart source

Upstream project: https://joinmastodon.org