StackRadarChart IndexLive demo

CVE-2026-45109

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 30; of 17,781 indexed, latest versions
Container images: 31; deployed by those charts
Fix available: 1 of 1; affected package

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Carried by container images the latest versions of 30 of 17,781 indexed charts deploy, on 31 images.

Affected package	Affected versions	Fixed in	Images
nextnpm	15.2.3, 15.2.4, 15.3.1, 15.3.3+14 more	15.5.18, 16.2.6	31

OSV records: GHSA-26hh-7cqf-hhc6

Charts affected

30 by stars

Chart

Latest

Affected images

Radar Score

difydouban

1 of 6 See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
langgenius/dify-web :1.10.1-fix.1	c306ac577912	next@15.5.7	15.5.18

Open the chart page →

19,391

umamichristianhuth

1 of 2 See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.18

Open the chart page →

2,367

cosmocosmo-platform

1 of 10 See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.5.18

Open the chart page →

28,839

coreinstill-ai

1 of 15 See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
instill/console :0.68.5	4cd70e2df5c6	next@15.4.7	15.5.18

Open the chart page →

30,816

nocodbzekker6

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	next@15.5.13	15.5.18

Open the chart page →

4,016

kikplatekikplate

1 of 3 See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/kikplate/kikplate-web :main	34bbb61e8e42	next@15.5.14	15.5.18

Open the chart page →

2,770

kube-ingress-dash-chartkube-ingress-dash

1 of 1 See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.2.6

Open the chart page →

1,505

bulwark-maill4g

1 of 1 See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/bulwarkmail/webmail :1.6.0	f0a266506fcf	next@16.2.4	16.2.6

Open the chart page →

800

karakeepself-hosters-by-night

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	next@15.3.3	15.5.18

Open the chart page →

5,213

vuiseriohub

1 of 3 See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
dserio83/velero-ui :0.3.1	b4e1ec6664d3	next@15.2.3	15.5.18

Open the chart page →

11,532

wachdwachd

1 of 1 See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	next@16.2.4	16.2.6

Open the chart page →

1,269

kamaji-consoleclastix

1 of 1 See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	next@15.2.3	15.5.18

Open the chart page →

2,759

desishowbiz-frontenddesishowbiz

1 of 1 See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
rahulbhiwagade122/desishowbiz :latest	08490b70998c	next@15.2.4	15.5.18

Open the chart page →

2,529

glassflow-etlglassflow

1 of 16 See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/glassflow/glassflow-etl-fe :v3.2.0	5eaad43bd6c5	next@16.0.10	16.2.6

Open the chart page →

12,056

lobe-chathelm-charts-darox

1 of 1 See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next@15.3.4	15.5.18

Open the chart page →

666

opencuthelmforge

1 of 5 See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
helmforge/opencut :v0.3.0	bf11156e0ab5	next@16.1.3	16.2.6

Open the chart page →

3,726

self-learning-platformhelm-self-learning-platform

1 of 1 See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
devopsiaci/self-learning-platform :1.1.3	d9441c931f75	next@16.1.6	16.2.6

Open the chart page →

1,468

pangolinkrzwiatrzyk

1 of 1 See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
fosrl/pangolin :1.13.0	c32ad797ab96	next@15.5.7	15.5.18

Open the chart page →

3,441

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
apecloud/aperag-frontend :v0.0.0-nightly	b3ae37840ace	next@15.4.8	15.5.18

Open the chart page →

8,405

homepagekubernetes-homelab-helm-charts

1 of 1 See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :v1.13.1	d8d784e50901	next@16.2.4	16.2.6

Open the chart page →

1,378

umamikubernetes-homelab-helm-charts

1 of 3 See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	next@16.2.4	16.2.6

Open the chart page →

2,596

magistralamagistrala-devops

1 of 42 See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.5.18

Open the chart page →

24,400

umamimt190502

1 of 3 See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.18

Open the chart page →

4,016

neosyncneosync

1 of 3 See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.18

Open the chart page →

7,184

appneosync-app

1 of 1 See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.18

Open the chart page →

1,569

alquimia-studioopenshift

1 of 1 See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.5.18

Open the chart page →

2,370

podscopepodscope

1 of 1 See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.2.6

Open the chart page →

1,484

pumperlypumperly

1 of 3 See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
drumsergio/pumperly :1.4.8	85bbc3915e9e	next@16.2.2	16.2.6

Open the chart page →

2,854

radar-self-enrolment-uiradar-base

1 of 1 See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.18

Open the chart page →

1,506

saleor-appstrieb-work

3 of 5 See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-45109.

Container image	Digest	Package	Fixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.18
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.18
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.18

Open the chart page →

6,994

Container images carrying it

31 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.18	2
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.5.18	1
apecloud/aperag-frontend :v0.0.0-nightly	b3ae37840ace	next@15.4.8	15.5.18	1
devopsiaci/self-learning-platform :1.1.3	d9441c931f75	next@16.1.6	16.2.6	1
drumsergio/pumperly :1.4.8	85bbc3915e9e	next@16.2.2	16.2.6	1
dserio83/velero-ui :0.3.1	b4e1ec6664d3	next@15.2.3	15.5.18	1
fosrl/pangolin :1.13.0	c32ad797ab96	next@15.5.7	15.5.18	1
helmforge/opencut :v0.3.0	bf11156e0ab5	next@16.1.3	16.2.6	1
instill/console :0.68.5	4cd70e2df5c6	next@15.4.7	15.5.18	1
langgenius/dify-web :1.10.1-fix.1	c306ac577912	next@15.5.7	15.5.18	1
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next@15.3.4	15.5.18	1
nocodb/nocodb :0.301.5	d9516f0bf546	next@15.5.13	15.5.18	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	next@15.2.4	15.5.18	1
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.5.18	1
ghcr.io/bulwarkmail/webmail :1.6.0	f0a266506fcf	next@16.2.4	16.2.6	1
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	next@15.2.3	15.5.18	1
ghcr.io/gethomepage/homepage :v1.13.1	d8d784e50901	next@16.2.4	16.2.6	1
ghcr.io/glassflow/glassflow-etl-fe :v3.2.0	5eaad43bd6c5	next@16.0.10	16.2.6	1
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.2.6	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	next@15.3.3	15.5.18	1
ghcr.io/kikplate/kikplate-web :main	34bbb61e8e42	next@15.5.14	15.5.18	1
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.18	1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.18	1
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.18	1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.18	1
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.18	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.18	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	next@16.2.4	16.2.6	1
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	next@16.2.4	16.2.6	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.2.6	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.5.18	1