StackRadar

CVE-2026-44574

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
19
of 17,781 indexed, latest versions
Container images
19
deployed by those charts
Fix available
1 of 1
affected package

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 19 images.

Affected packageAffected versionsFixed inImages
nextnpm15.4.7, 15.4.8, 15.5.4, 15.5.7+9 more15.5.16, 16.2.519
OSV records
GHSA-492v-c6pp-mqqv

Charts affected

19 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.16

Open the chart page →

19,391
umamichristianhuthVerified publisher7.13.01 of 2See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.16

Open the chart page →

2,367
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.5.16

Open the chart page →

30,816
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.16

Open the chart page →

4,016
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.16

Open the chart page →

2,770
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.5

Open the chart page →

1,505
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.2.5

Open the chart page →

800
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.5

Open the chart page →

1,269
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.2.5

Open the chart page →

12,056
opencuthelmforgeVerified publisher1.1.91 of 5See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.2.5

Open the chart page →

3,726
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.2.5

Open the chart page →

1,468
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.16

Open the chart page →

3,441
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.16

Open the chart page →

8,405
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.2.5

Open the chart page →

1,378
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.5

Open the chart page →

2,596
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.16

Open the chart page →

4,016
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.2.5

Open the chart page →

1,484
pumperlypumperlyVerified publisher0.1.21 of 3See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.4.885bbc3915e9e
next@16.2.2
16.2.5

Open the chart page →

2,854
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-44574.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.16

Open the chart page →

1,506

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.16
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.2.5
1
drumsergio/pumperly:1.4.885bbc3915e9e
next@16.2.2
16.2.5
1
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.16
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.2.5
1
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.5.16
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.16
1
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.16
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.2.5
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.2.5
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.2.5
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.2.5
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.16
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.16
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.16
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.16
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.5
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.5
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.