StackRadarChart IndexLive demo

CVE-2026-44575

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.016; 74th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 30; of 17,781 indexed, latest versions
Container images: 31; deployed by those charts
Fix available: 1 of 1; affected package

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Carried by container images the latest versions of 30 of 17,781 indexed charts deploy, on 31 images.

Affected package	Affected versions	Fixed in	Images
nextnpm	15.2.3, 15.2.4, 15.3.1, 15.3.3+14 more	15.5.16, 16.2.5	31

OSV records: GHSA-267c-6grr-h53f

Charts affected

30 by stars

Chart

Latest

Affected images

Radar Score

difydouban

1 of 6 See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
langgenius/dify-web :1.10.1-fix.1	c306ac577912	next@15.5.7	15.5.16

Open the chart page →

19,391

umamichristianhuth

1 of 2 See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.16

Open the chart page →

2,367

cosmocosmo-platform

1 of 10 See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.5.16

Open the chart page →

28,839

coreinstill-ai

1 of 15 See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
instill/console :0.68.5	4cd70e2df5c6	next@15.4.7	15.5.16

Open the chart page →

30,816

nocodbzekker6

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	next@15.5.13	15.5.16

Open the chart page →

4,016

kikplatekikplate

1 of 3 See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/kikplate/kikplate-web :main	34bbb61e8e42	next@15.5.14	15.5.16

Open the chart page →

2,770

kube-ingress-dash-chartkube-ingress-dash

1 of 1 See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.2.5

Open the chart page →

1,505

bulwark-maill4g

1 of 1 See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/bulwarkmail/webmail :1.6.0	f0a266506fcf	next@16.2.4	16.2.5

Open the chart page →

800

karakeepself-hosters-by-night

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	next@15.3.3	15.5.16

Open the chart page →

5,213

vuiseriohub

1 of 3 See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
dserio83/velero-ui :0.3.1	b4e1ec6664d3	next@15.2.3	15.5.16

Open the chart page →

11,532

wachdwachd

1 of 1 See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	next@16.2.4	16.2.5

Open the chart page →

1,269

kamaji-consoleclastix

1 of 1 See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	next@15.2.3	15.5.16

Open the chart page →

2,759

desishowbiz-frontenddesishowbiz

1 of 1 See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
rahulbhiwagade122/desishowbiz :latest	08490b70998c	next@15.2.4	15.5.16

Open the chart page →

2,529

glassflow-etlglassflow

1 of 16 See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/glassflow/glassflow-etl-fe :v3.2.0	5eaad43bd6c5	next@16.0.10	16.2.5

Open the chart page →

12,056

lobe-chathelm-charts-darox

1 of 1 See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next@15.3.4	15.5.16

Open the chart page →

666

opencuthelmforge

1 of 5 See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
helmforge/opencut :v0.3.0	bf11156e0ab5	next@16.1.3	16.2.5

Open the chart page →

3,726

self-learning-platformhelm-self-learning-platform

1 of 1 See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
devopsiaci/self-learning-platform :1.1.3	d9441c931f75	next@16.1.6	16.2.5

Open the chart page →

1,468

pangolinkrzwiatrzyk

1 of 1 See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
fosrl/pangolin :1.13.0	c32ad797ab96	next@15.5.7	15.5.16

Open the chart page →

3,441

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
apecloud/aperag-frontend :v0.0.0-nightly	b3ae37840ace	next@15.4.8	15.5.16

Open the chart page →

8,405

homepagekubernetes-homelab-helm-charts

1 of 1 See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :v1.13.1	d8d784e50901	next@16.2.4	16.2.5

Open the chart page →

1,378

umamikubernetes-homelab-helm-charts

1 of 3 See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	next@16.2.4	16.2.5

Open the chart page →

2,596

magistralamagistrala-devops

1 of 42 See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.5.16

Open the chart page →

24,400

umamimt190502

1 of 3 See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.16

Open the chart page →

4,016

neosyncneosync

1 of 3 See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.16

Open the chart page →

7,184

appneosync-app

1 of 1 See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.16

Open the chart page →

1,569

alquimia-studioopenshift

1 of 1 See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.5.16

Open the chart page →

2,370

podscopepodscope

1 of 1 See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.2.5

Open the chart page →

1,484

pumperlypumperly

1 of 3 See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
drumsergio/pumperly :1.4.8	85bbc3915e9e	next@16.2.2	16.2.5

Open the chart page →

2,854

radar-self-enrolment-uiradar-base

1 of 1 See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.16

Open the chart page →

1,506

saleor-appstrieb-work

3 of 5 See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-44575.

Container image	Digest	Package	Fixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.16
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.16
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.16

Open the chart page →

6,994

Container images carrying it

31 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.16	2
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.5.16	1
apecloud/aperag-frontend :v0.0.0-nightly	b3ae37840ace	next@15.4.8	15.5.16	1
devopsiaci/self-learning-platform :1.1.3	d9441c931f75	next@16.1.6	16.2.5	1
drumsergio/pumperly :1.4.8	85bbc3915e9e	next@16.2.2	16.2.5	1
dserio83/velero-ui :0.3.1	b4e1ec6664d3	next@15.2.3	15.5.16	1
fosrl/pangolin :1.13.0	c32ad797ab96	next@15.5.7	15.5.16	1
helmforge/opencut :v0.3.0	bf11156e0ab5	next@16.1.3	16.2.5	1
instill/console :0.68.5	4cd70e2df5c6	next@15.4.7	15.5.16	1
langgenius/dify-web :1.10.1-fix.1	c306ac577912	next@15.5.7	15.5.16	1
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next@15.3.4	15.5.16	1
nocodb/nocodb :0.301.5	d9516f0bf546	next@15.5.13	15.5.16	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	next@15.2.4	15.5.16	1
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.5.16	1
ghcr.io/bulwarkmail/webmail :1.6.0	f0a266506fcf	next@16.2.4	16.2.5	1
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	next@15.2.3	15.5.16	1
ghcr.io/gethomepage/homepage :v1.13.1	d8d784e50901	next@16.2.4	16.2.5	1
ghcr.io/glassflow/glassflow-etl-fe :v3.2.0	5eaad43bd6c5	next@16.0.10	16.2.5	1
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.2.5	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	next@15.3.3	15.5.16	1
ghcr.io/kikplate/kikplate-web :main	34bbb61e8e42	next@15.5.14	15.5.16	1
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.16	1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.16	1
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.16	1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.16	1
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.16	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.16	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	next@16.2.4	16.2.5	1
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	next@16.2.4	16.2.5	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.2.5	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.5.16	1