StackRadar

CVE-2026-94484

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
81
of 18,053 indexed, latest versions
Container images
78
deployed by those charts
Fix available
1 of 1
affected package

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

Carried by container images the latest versions of 81 of 18,053 indexed charts deploy, on 78 images.

Affected packageAffected versionsFixed inImages
nextnpm15.0.1, 15.2.3, 15.2.4, 15.3.1+30 more15.5.27, 16.3.878
OSV records
GHSA-mcj8-r9mp-w47p

Charts affected

81 by stars
ChartLatestAffected imagesRadar Score
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.27

Open the chart page →

9,503
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.8

Open the chart page →

1,554
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.8

Open the chart page →

1,844
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.8

Open the chart page →

2,802
helm-pilotlbenicio-communityVerified publisher0.2.41 of 1See more

helm-pilot lbenicio-community 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.8

Open the chart page →

867
lynxpromptlynxpromptVerified publisher0.1.31 of 3See more

lynxprompt lynxprompt 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.8

Open the chart page →

2,226
homepagem0sh1-helm-charts0.3.11 of 1See more

homepage m0sh1-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
next@15.5.11
15.5.27

Open the chart page →

2,011
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.5.27

Open the chart page →

31,487
homarrmedia-servarrVerified publisher0.56.01 of 1See more

homarr media-servarr 0.56.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.3.8

Open the chart page →

738
miot-appmicroboxlabs0.3.31 of 1See more

miot-app microboxlabs 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8

Open the chart page →

666
miot-docsmicroboxlabs0.1.11 of 1See more

miot-docs microboxlabs 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-docs:latestb528e6a1d9d5
next@16.3.5
16.3.8

Open the chart page →

284
miot-stackmicroboxlabs0.2.21 of 2See more

miot-stack microboxlabs 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8

Open the chart page →

666
modulariotmicroboxlabs0.11.02 of 4See more

modulariot microboxlabs 0.11.0

2 of the 4 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
next@16.3.5
16.3.8

Open the chart page →

2,626
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.27

Open the chart page →

4,227
neosyncneosyncVerified publisher0.5.411 of 3See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.27

Open the chart page →

8,481
appneosync-appVerified publisher0.5.411 of 1See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.27

Open the chart page →

1,706
alquimia-studioopenshift0.2.01 of 1See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.27

Open the chart page →

2,602
dify-enterpriseopenshift3.9.82 of 13See more

dify-enterprise openshift 3.9.8

2 of the 13 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.8
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.8

Open the chart page →

7,412
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.3.8

Open the chart page →

1,623
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8

Open the chart page →

2,800
homepagequench-homepageVerified publisher0.0.71 of 1See more

homepage quench-homepage 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/homepagedigest-pinnedb63a85533463
next@16.3.6
16.3.8

Open the chart page →

90
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.27

Open the chart page →

1,644
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.8

Open the chart page →

8,377
seerr-chartseerr-chartVerified publisher3.10.01 of 1See more

seerr-chart seerr-chart 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
next@16.2.6
16.3.8

Open the chart page →

2,299
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.8

Open the chart page →

10,744
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.27
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.27
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.27

Open the chart page →

9,160
altinnendata-apptumogroup0.1.241 of 1See more

altinnendata-app tumogroup 0.1.24

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
sondresjo/altinnendata-app:v1.9.81c850e7bb963
next@16.3.6
16.3.8

Open the chart page →

931
nstuning-apptumogroup0.1.231 of 1See more

nstuning-app tumogroup 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
sondresjo/nstuning-app:v1.6.1620805ad01071
next@16.3.6
16.3.8

Open the chart page →

931
pyttogpanne-apptumogroup0.1.61 of 1See more

pyttogpanne-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
sondresjo/pyttogpanne-app:v1.0.5e9a8d7e36e71
next@16.3.6
16.3.8

Open the chart page →

931
sjolystinnovation-apptumogroup0.1.61 of 1See more

sjolystinnovation-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
sondresjo/sjolystinnovation-app:v1.3.11a315219c9c2
next@16.3.6
16.3.8

Open the chart page →

931
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-94484.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8

Open the chart page →

662

Container images carrying it

78 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8
3
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.27
2
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.3.8
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.27
2
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
next@16.2.6
16.3.8
2
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8
2
agentarea/agentarea-frontend:latest56360a626a00
next@16.3.6
16.3.8
1
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.27
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.27
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.8
1
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.8
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.27
1
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
next@15.5.24
15.5.27
1
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.8
1
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.27
1
growthbook/growthbook:latest67b7cd7d12a1
next@16.3.5
16.3.8
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.8
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.8
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.8
1
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.8
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.27
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.8
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.27
1
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.27
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.8
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.27
1
sondresjo/altinnendata-app:v1.9.81c850e7bb963
next@16.3.6
16.3.8
1
sondresjo/nstuning-app:v1.6.1620805ad01071
next@16.3.6
16.3.8
1
sondresjo/pyttogpanne-app:v1.0.5e9a8d7e36e71
next@16.3.6
16.3.8
1
sondresjo/sjolystinnovation-app:v1.3.11a315219c9c2
next@16.3.6
16.3.8
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.8
1
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.8
1
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.5.27
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8
1
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.8
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.8
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.27
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
next@15.5.11
15.5.27
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.8
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.8
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.8
1
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
next@16.3.6
16.3.8
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.3.8
1
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.8
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.