StackRadarChart IndexLive demo

CVE-2026-64649

High

Advisory

Published 22 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.3; base score, highest
EPSS: 0.009; 57th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 68; of 17,781 indexed, latest versions
Container images: 66; deployed by those charts
Fix available: 1 of 1; affected package

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 66 images.

Affected package	Affected versions	Fixed in	Images
nextnpm	14.1.1, 14.1.3, 14.1.4, 14.2.2+35 more	15.5.21, 16.2.11	66

OSV records: GHSA-89xv-2m56-2m9x

Charts affected

68 by stars

Chart

Latest

Affected images

Radar Score

magistralamagistrala-devops

1 of 42 See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.5.21

Open the chart page →

24,400

miot-appmicroboxlabs

1 of 1 See more

miot-app microboxlabs 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/microboxlabs/miot-app :0.5.20	3cc10a496ced	next@16.2.6	16.2.11

Open the chart page →

509

miot-stackmicroboxlabs

1 of 2 See more

miot-stack microboxlabs 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/microboxlabs/miot-app :0.5.20	3cc10a496ced	next@16.2.6	16.2.11

Open the chart page →

509

modulariotmicroboxlabs

1 of 4 See more

modulariot microboxlabs 0.9.0

1 of the 4 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/microboxlabs/miot-app :0.5.20	3cc10a496ced	next@16.2.6	16.2.11

Open the chart page →

2,256

umamimt190502

1 of 3 See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.21

Open the chart page →

4,016

neosyncneosync

1 of 3 See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.21

Open the chart page →

7,184

appneosync-app

1 of 1 See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.5.21

Open the chart page →

1,569

openlitopenlit

1 of 3 See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/openlit/openlit :1.24.0	2434560e8f0e	next@14.2.4	15.5.21

Open the chart page →

5,017

alquimia-studioopenshift

1 of 1 See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.5.21

Open the chart page →

2,370

dify-enterpriseopenshift

2 of 13 See more

dify-enterprise openshift 3.9.8

2 of the 13 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
langgenius/dify-ee-enterprise-frontend :3.9.8-ubi9	8dd9de6b6190	next@16.2.6	16.2.11
langgenius/dify-ee-web :3.9.8-ubi9	ba1dd1d0bcea	next@16.2.6	16.2.11

Open the chart page →

4,660

podscopepodscope

1 of 1 See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.2.11

Open the chart page →

1,484

pumperlypumperly

1 of 3 See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
drumsergio/pumperly :1.4.8	85bbc3915e9e	next@16.2.2	16.2.11

Open the chart page →

2,854

radar-self-enrolment-uiradar-base

1 of 1 See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.21

Open the chart page →

1,506

karakeeprtomik-helm-charts

1 of 3 See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.26.0	f575a34ed3f8	next@14.2.25	15.5.21

Open the chart page →

5,338

rybbitrybbit-helm

1 of 7 See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/rybbit-io/rybbit-client :latest	9a3bbb2e837a	next@16.2.6	16.2.11

Open the chart page →

5,819

seerr-chartseerr-chart

1 of 1 See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/seerr-team/seerr :v3.4.1	f4768de5f616	next@16.2.6	16.2.11

Open the chart page →

1,991

saleor-appstrieb-work

3 of 5 See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-64649.

Container image	Digest	Package	Fixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.21
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.21
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.21

Open the chart page →

6,994

sirenwateim

1 of 1 See more

5,984

Container images carrying it

66 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/rybbit-io/rybbit-client :latest	9a3bbb2e837a	next@16.2.6	16.2.11	1
ghcr.io/seerr-team/seerr :v3.2.0	c4cbd5121236	next@14.2.35	15.5.21	1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.21	1
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.21	1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.21	1
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.21	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.21	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	next@16.2.4	16.2.11	1
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	next@16.2.4	16.2.11	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.2.11	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.5.21	1
ghcr.io/zoriya/kyoo_front :4.7.1	d7f76c9c65d9	next@14.2.5	15.5.21	1
public.ecr.aws/flanksource/incident-manager-ui :v1.4.317	fea799d4fb2f	next@15.5.20	15.5.21	1
quay.io/kuberay/dashboard :v1.7.0	7e43d4b4fd9f	next@15.5.18	15.5.21	1
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	next@14.2.32	15.5.21	1
registry.gitlab.com/dyff/dyff-frontend :0.20.1	52549f52ae53	next@15.5.18	15.5.21	1