StackRadar

CVE-2026-103004

Medium

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 18,232 indexed, latest versions
Container images
19
deployed by those charts
Fix available
1 of 1
affected package

next.js cache leak across root param values in nested 'use cache' functions

Carried by container images the latest versions of 21 of 18,232 indexed charts deploy, on 19 images.

Affected packageAffected versionsFixed inImages
nextnpm16.3.0, 16.3.1, 16.3.2, 16.3.3+3 more16.3.819
OSV records
GHSA-h694-7cp9-m8p3

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
langgenius/dify-web:1.17.06a81fcdd82b5
next@16.3.2
16.3.8

Open the chart page →

64,010
homarrhomarr-labsOfficialVerified publisher8.37.01 of 1See more

homarr homarr-labs 8.37.0

1 of the 1 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.7.0f532ce7cb2a3
next@16.3.6
16.3.8

Open the chart page →

218
umamichristianhuthVerified publisher8.0.01 of 1See more

umami christianhuth 8.0.0

1 of the 1 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8

Open the chart page →

341
umamihelmforgeVerified publisher2.4.21 of 3See more

umami helmforge 2.4.2

1 of the 3 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8

Open the chart page →

2,078
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8

Open the chart page →

1,209
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8

Open the chart page →

2,370
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8

Open the chart page →

1,390
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8

Open the chart page →

814
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8

Open the chart page →

28,074
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
fosrl/pangolin:latest17774ddbb4bf
next@16.3.5
16.3.8

Open the chart page →

2,355
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8

Open the chart page →

4,017
homarrhelmforgeVerified publisher1.2.141 of 1See more

homarr helmforge 1.2.14

1 of the 1 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
next@16.3.6
16.3.8

Open the chart page →

218
reactive-resumehelmforgeVerified publisher1.0.21 of 4See more

reactive-resume helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8

Open the chart page →

4,156
kagentkagent0.10.41 of 6See more

kagent kagent 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/ui:0.10.4a6edf70c6e8e
next@16.3.5
16.3.8

Open the chart page →

4,155
umamikubernetes-homelab-helm-chartsVerified publisher0.3.01 of 3See more

umami kubernetes-homelab-helm-charts 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8

Open the chart page →

1,044
miot-docsmicroboxlabs0.1.11 of 1See more

miot-docs microboxlabs 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-docs:latestd3431480deea
next@16.3.5
16.3.8

Open the chart page →

314
modulariotmicroboxlabs0.11.11 of 4See more

modulariot microboxlabs 0.11.1

1 of the 4 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-docs:latest893259699070
next@16.3.5
16.3.8

Open the chart page →

1,069
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8

Open the chart page →

3,004
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
supabase/studio:latestd878dcd9dba7
next@16.3.6
16.3.8

Open the chart page →

32,654
homepagethis-is-tobi-helm-chartsVerified publisher0.1.01 of 1See more

homepage this-is-tobi-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

779
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-103004.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8

Open the chart page →

795

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8
3
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8
1
fosrl/pangolin:latest17774ddbb4bf
next@16.3.5
16.3.8
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8
1
langgenius/dify-web:1.17.06a81fcdd82b5
next@16.3.2
16.3.8
1
supabase/studio:latestd878dcd9dba7
next@16.3.6
16.3.8
1
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8
1
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
next@16.3.6
16.3.8
1
ghcr.io/homarr-labs/homarr:v2.7.0f532ce7cb2a3
next@16.3.6
16.3.8
1
ghcr.io/kagent-dev/kagent/ui:0.10.4a6edf70c6e8e
next@16.3.5
16.3.8
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8
1
ghcr.io/microboxlabs/miot-docs:latest893259699070
next@16.3.5
16.3.8
1
ghcr.io/microboxlabs/miot-docs:latestd3431480deea
next@16.3.5
16.3.8
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.