StackRadar

CVE-2026-53666

Medium

Advisory

Published 23 Jul 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
35
of 17,781 indexed, latest versions
Container images
36
deployed by those charts
Fix available
1 of 1
affected package

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 36 images.

Affected packageAffected versionsFixed inImages
react-routernpm6.7.0, 6.9.0, 6.10.0, 6.13.0+17 more7.18.036
OSV records
GHSA-337j-9hxr-rhxg

Charts affected

35 by stars
ChartLatestAffected imagesRadar Score
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
react-router@6.13.0
7.18.0

Open the chart page →

3,795
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
react-router@6.22.0
7.18.0

Open the chart page →

2,654
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
react-router@7.1.1
7.18.0

Open the chart page →

7,949
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
react-router@7.6.0
7.18.0

Open the chart page →

1,152
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
react-router@7.13.0
7.18.0

Open the chart page →

1,044
jellystatdjjudas21Verified publisher0.1.121 of 1See more

jellystat djjudas21 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
react-router@6.30.4
7.18.0

Open the chart page →

1,722
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
react-router@6.30.0
7.18.0

Open the chart page →

6,873
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
react-router@6.26.1
7.18.0

Open the chart page →

12,581
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
react-router@6.28.0
7.18.0
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
react-router@6.30.0
7.18.0
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
react-router@6.30.0
7.18.0

Open the chart page →

18,293
stocksalescluster-deploy0.1.31 of 1See more

stocksales cluster-deploy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
foggbh/stocky:latest8b7a2e5ecf4e
react-router@7.12.0
7.18.0

Open the chart page →

408
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
react-router@6.7.0
7.18.0

Open the chart page →

9,146
defactopsdefactops1.0.91 of 2See more

defactops defactops 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
defactops/defactops-ui:1.0.16825cdf9ba706
react-router@6.21.3
7.18.0

Open the chart page →

4,509
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
react-router@6.26.2
7.18.0

Open the chart page →

4,251
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
react-router@6.20.0
7.18.0

Open the chart page →

4,650
flanksource-uiflanksourceVerified publisher1.4.3181 of 1See more

flanksource-ui flanksource 1.4.318

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.318891f21df54fb
react-router@6.30.4
7.18.0

Open the chart page →

2,558
mission-controlflanksourceVerified publisher0.1.3361 of 8See more

mission-control flanksource 0.1.336

1 of the 8 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
react-router@6.30.4
7.18.0

Open the chart page →

8,902
littlelink-servergeek-cookbookVerified publisher1.4.21 of 1See more

littlelink-server geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
react-router@6.30.1
7.18.0

Open the chart page →

819
littlelink-serverh2mVerified publisher1.0.11 of 1See more

littlelink-server h2m 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
react-router@6.30.1
7.18.0

Open the chart page →

819
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
react-router@6.22.0
7.18.0

Open the chart page →

2,950
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
react-router@6.30.0
7.18.0

Open the chart page →

5,769
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
react-router@7.13.0
7.18.0

Open the chart page →

6,012
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
react-router@6.30.6
7.18.0

Open the chart page →

2,061
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
react-router@6.26.1
7.18.0

Open the chart page →

11,812
locust-pluginslocust-pluginsVerified publisher0.0.41 of 3See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
sky5367/locust-plugins-grafana:latestd51bf68d4b26
react-router@6.21.3
7.18.0

Open the chart page →

7,510
littlelink-servermhamzahkhanVerified publisher1.0.01 of 1See more

littlelink-server mhamzahkhan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
react-router@6.25.1
7.18.0

Open the chart page →

887
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
grafana/grafana:10.4.0f9811e4e687f
react-router@6.21.3
7.18.0

Open the chart page →

7,309
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
react-router@6.10.0
7.18.0

Open the chart page →

17,929
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
react-router@6.14.2
7.18.0

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
react-router@6.14.2
7.18.0

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
react-router@6.9.0
7.18.0

Open the chart page →

15,187
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
react-router@6.26.2
7.18.0

Open the chart page →

3,271
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
react-router@6.26.2
7.18.0

Open the chart page →

5,497
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
react-router@6.30.4
7.18.0

Open the chart page →

676
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
react-router@7.13.1
7.18.0

Open the chart page →

3,972
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-53666.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
react-router@6.30.4
7.18.0

Open the chart page →

5,550

Container images carrying it

36 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
react-router@6.30.1
7.18.0
2
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
react-router@6.26.2
7.18.0
1
automatischio/automatisch:0.15.03bace7a12d5f
react-router@6.30.0
7.18.0
1
coldatom/containers-security-front:latest7c2fbbb41bcf
react-router@6.7.0
7.18.0
1
contane/foreman:0.5.2efb98bdcc4e9
react-router@7.6.0
7.18.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
react-router@6.30.4
7.18.0
1
defactops/defactops-ui:1.0.16825cdf9ba706
react-router@6.21.3
7.18.0
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
react-router@6.20.0
7.18.0
1
flanksource/incident-manager-ui:v1.4.318891f21df54fb
react-router@6.30.4
7.18.0
1
foggbh/stocky:latest8b7a2e5ecf4e
react-router@7.12.0
7.18.0
1
grafana/grafana:10.4.0f9811e4e687f
react-router@6.21.3
7.18.0
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
react-router@6.10.0
7.18.0
1
helmforge/strapi-base:5.52.270e9143d6d92
react-router@6.30.6
7.18.0
1
kyleslugg/klusterview:latestba8c36dfdfbd
react-router@6.13.0
7.18.0
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
react-router@6.26.2
7.18.0
1
sky5367/locust-plugins-grafana:latestd51bf68d4b26
react-router@6.21.3
7.18.0
1
tensorzero/ui:2026.6.0f2563d54724e
react-router@7.13.1
7.18.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
react-router@6.30.4
7.18.0
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
react-router@6.26.1
7.18.0
1
vlebediantsev/notes-admin-front:latest007c6670ff48
react-router@6.14.2
7.18.0
1
vlebediantsev/notes-project-front:latest945675fd2636
react-router@6.14.2
7.18.0
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
react-router@6.9.0
7.18.0
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
react-router@6.22.0
7.18.0
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
react-router@6.22.0
7.18.0
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
react-router@6.28.0
7.18.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
react-router@6.30.0
7.18.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
react-router@6.30.0
7.18.0
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
react-router@7.13.0
7.18.0
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
react-router@6.26.2
7.18.0
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
react-router@6.26.1
7.18.0
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
react-router@7.1.1
7.18.0
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
react-router@6.25.1
7.18.0
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
react-router@7.13.0
7.18.0
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
react-router@6.30.0
7.18.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
react-router@6.30.4
7.18.0
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
react-router@6.30.4
7.18.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.