StackRadar

CVE-2026-44573

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
48th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
68
of 17,781 indexed, latest versions
Container images
67
deployed by those charts
Fix available
1 of 1
affected package

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 67 images.

Affected packageAffected versionsFixed inImages
nextnpm12.3.1, 12.3.2, 12.3.4, 13.0.7+40 more15.5.16, 16.2.567
OSV records
GHSA-36qx-fr4f-26g5

Charts affected

68 by stars
ChartLatestAffected imagesRadar Score
dashboardleechistest1.0.01 of 1See more

dashboard leechistest 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
next@14.2.3
15.5.16

Open the chart page →

1,344
hyperglassm0nsterrr-hyperglassVerified publisher4.2.11 of 2See more

hyperglass m0nsterrr-hyperglass 4.2.1

1 of the 2 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
next@13.5.6
15.5.16

Open the chart page →

4,647
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.5.16

Open the chart page →

24,400
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.16

Open the chart page →

4,016
neosyncneosyncVerified publisher0.5.411 of 3See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.16

Open the chart page →

7,184
appneosync-appVerified publisher0.5.411 of 1See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.16

Open the chart page →

1,569
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
next@14.2.4
15.5.16

Open the chart page →

5,017
alquimia-studioopenshift0.2.01 of 1See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.16

Open the chart page →

2,370
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.2.5

Open the chart page →

1,484
pumperlypumperlyVerified publisher0.1.21 of 3See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.4.885bbc3915e9e
next@16.2.2
16.2.5

Open the chart page →

2,854
kratos-selfservice-ui-noderadar-baseVerified publisher0.43.11 of 1See more

kratos-selfservice-ui-node radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
next@13.5.3
15.5.16

Open the chart page →

2,969
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.16

Open the chart page →

1,506
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.16

Open the chart page →

5,338
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.16

Open the chart page →

4,820
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.16
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.16
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.16

Open the chart page →

6,994
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.16

Open the chart page →

2,789
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.16

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-44573.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.16

Open the chart page →

5,984

Container images carrying it

67 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
next@14.2.5
15.5.16
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.16
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
next@12.3.4
15.5.16
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
next@14.2.35
15.5.16
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.16
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.16
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.16
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.16
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
next@12.3.2
15.5.16
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.16
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.5
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.5
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.16
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.5
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.16
1
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
next@14.2.5
15.5.16
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
next@14.2.32
15.5.16
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.