StackRadar

CVE-2026-94482

High

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
115
of 18,232 indexed, latest versions
Container images
109
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Denial of Service in App Router using Server Actions

Carried by container images the latest versions of 115 of 18,232 indexed charts deploy, on 109 images.

Affected packageAffected versionsFixed inImages
nextnpm13.0.7, 13.2.4, 13.4.12, 13.5.2+55 more15.5.28, 16.4.1109
OSV records
GHSA-p3m5-59mp-jv5r

Charts affected

115 by stars
ChartLatestAffected imagesRadar Score
homepagequench-homepageVerified publisher0.0.121 of 1See more

homepage quench-homepage 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/homepagedigest-pinnede9d1b2799f06
next@16.3.8
16.4.1

Open the chart page →

78
kratos-selfservice-ui-noderadar-baseVerified publisher0.43.11 of 1See more

kratos-selfservice-ui-node radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
next@13.5.3
15.5.28

Open the chart page →

3,127
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.28

Open the chart page →

1,646
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.28

Open the chart page →

6,483
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.4.1

Open the chart page →

9,183
seerr-chartseerr-chartVerified publisher3.10.11 of 1See more

seerr-chart seerr-chart 3.10.1

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
next@16.2.6
16.4.1

Open the chart page →

2,212
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.28

Open the chart page →

5,381
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
supabase/studio:latestd878dcd9dba7
next@16.3.6
16.4.1

Open the chart page →

32,654
homepagethis-is-tobi-helm-chartsVerified publisher0.1.01 of 1See more

homepage this-is-tobi-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.4.1

Open the chart page →

779
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.28
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.28
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.28

Open the chart page →

9,644
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.4.1

Open the chart page →

795
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.28

Open the chart page →

3,550
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.28

Open the chart page →

4,316
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.28

Open the chart page →

6,439
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-94482.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
next@14.1.4
15.5.28

Open the chart page →

1,682

Container images carrying it

109 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
next@14.1.1
15.5.28
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.5.28
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
next@13.4.12
15.5.28
1
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
next@13.4.12
15.5.28
1
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.28
1
ghcr.io/akash-network/deploy-web:2.46.0ac540172c120
next@14.2.23
15.5.28
1
ghcr.io/akash-network/provider-console:1.0.04d4c19a8d3ff
next@14.2.23
15.5.28
1
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
next@14.1.4
15.5.28
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.4.1
1
ghcr.io/bulwarkmail/webmail:1.15.0-always6345944b2cba
next@16.3.8
16.4.1
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.4.1
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.28
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.4.1
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.4.1
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
next@14.2.25
15.5.28
1
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.4.1
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.4.1
1
ghcr.io/gethomepage/homepage:v1.13.2a0b71c8e7572
next@16.2.6
16.4.1
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
next@15.5.11
15.5.28
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.4.1
1
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
next@16.3.6
16.4.1
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.4.1
1
ghcr.io/homarr-labs/homarr:v2.7.0f532ce7cb2a3
next@16.3.6
16.4.1
1
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
next@16.1.6
16.4.1
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.4.1
1
ghcr.io/kagent-dev/kagent/ui:0.10.4a6edf70c6e8e
next@16.3.5
16.4.1
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.28
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.28
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.28
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.4.1
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.28
1
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
next@13.4.12
15.5.28
1
ghcr.io/lockdep/stackradar-client:0.2.01ef6c7132778
next@16.4.0
16.4.1
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
next@13.5.6
15.5.28
1
ghcr.io/microboxlabs/miot-docs:latest893259699070
next@16.3.5
16.4.1
1
ghcr.io/microboxlabs/miot-docs:latestd3431480deea
next@16.3.5
16.4.1
1
ghcr.io/multica-ai/multica-web:v0.6.5f38d02584705
next@16.3.8
16.4.1
1
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.28
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
next@14.2.4
15.5.28
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.4.1
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
next@14.2.5
15.5.28
1
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
next@14.2.5
15.5.28
1
ghcr.io/quenchworks/images/homepagee9d1b2799f06
next@16.3.8
16.4.1
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.28
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.4.1
1
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
next@16.2.6
16.4.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.28
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.28
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.28
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.28
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.