StackRadar

CVE-2026-64642

High

Advisory

Published 22 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.010
61st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
nextnpm16.0.3, 16.0.10, 16.1.3, 16.1.6+6 more16.2.1121
OSV records
GHSA-6gpp-xcg3-4w24

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
next@16.2.6
16.2.11

Open the chart page →

3,004
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
next@16.2.9
16.2.11

Open the chart page →

1,870
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.2.11

Open the chart page →

1,991
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.11

Open the chart page →

1,505
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.2.11

Open the chart page →

800
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
next@16.2.10
16.2.11

Open the chart page →

22,420
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.2.11

Open the chart page →

8,158
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.11

Open the chart page →

1,269
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.2.11

Open the chart page →

12,056
opencuthelmforgeVerified publisher1.1.91 of 5See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.2.11

Open the chart page →

3,726
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.2.11

Open the chart page →

1,468
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.2.11

Open the chart page →

1,378
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.2.11

Open the chart page →

1,498
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.11

Open the chart page →

2,596
helm-pilotlbenicio-communityVerified publisher0.2.41 of 1See more

helm-pilot lbenicio-community 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.2.11

Open the chart page →

710
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.2.11

Open the chart page →

1,852
miot-appmicroboxlabs0.3.31 of 1See more

miot-app microboxlabs 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.2.11

Open the chart page →

509
miot-stackmicroboxlabs0.2.21 of 2See more

miot-stack microboxlabs 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.2.11

Open the chart page →

509
modulariotmicroboxlabs0.9.01 of 4See more

modulariot microboxlabs 0.9.0

1 of the 4 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.2.11

Open the chart page →

2,256
dify-enterpriseopenshift3.9.82 of 13See more

dify-enterprise openshift 3.9.8

2 of the 13 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.2.11
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.2.11

Open the chart page →

4,660
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.2.11

Open the chart page →

1,484
pumperlypumperlyVerified publisher0.1.21 of 3See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.4.885bbc3915e9e
next@16.2.2
16.2.11

Open the chart page →

2,854
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.2.11

Open the chart page →

5,819
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-64642.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.2.11

Open the chart page →

1,991

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.2.11
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
next@16.2.6
16.2.11
3
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.2.11
1
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.2.11
1
drumsergio/pumperly:1.4.885bbc3915e9e
next@16.2.2
16.2.11
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.2.11
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.2.11
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.2.11
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.2.11
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.2.11
1
wsjbr/duplistatus:1.4.25e594f5f09f6
next@16.2.9
16.2.11
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.2.11
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.2.11
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.2.11
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.2.11
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.2.11
1
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
next@16.2.10
16.2.11
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.2.11
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.11
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.11
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.11
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.