StackRadar

CVE-2026-94543

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
19th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
81
of 18,053 indexed, latest versions
Container images
78
deployed by those charts
Fix available
1 of 1
affected package

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Carried by container images the latest versions of 81 of 18,053 indexed charts deploy, on 78 images.

Affected packageAffected versionsFixed inImages
nextnpm15.0.1, 15.2.3, 15.2.4, 15.3.1+30 more15.5.27, 16.3.878
OSV records
GHSA-4jqv-mc3x-m676

Charts affected

81 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.27

Open the chart page →

82,159
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.8

Open the chart page →

72,701
homarrhomarr-labsOfficialVerified publisher8.32.01 of 1See more

homarr homarr-labs 8.32.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
next@16.3.6
16.3.8

Open the chart page →

420
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
next@16.2.6
16.3.8

Open the chart page →

3,557
homepagem0nsterrr-homepageVerified publisher5.4.01 of 1See more

homepage m0nsterrr-homepage 5.4.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

648
umamichristianhuthVerified publisher7.14.11 of 2See more

umami christianhuth 7.14.1

1 of the 2 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.27

Open the chart page →

2,525
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.8

Open the chart page →

11,804
umamihelmforgeVerified publisher2.3.41 of 3See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8

Open the chart page →

1,997
cosmocosmo-platformOfficialVerified publisher0.21.01 of 10See more

cosmo cosmo-platform 0.21.0

1 of the 10 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.27

Open the chart page →

34,376
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8

Open the chart page →

1,080
flyte-binaryflyte2.0.511 of 4See more

flyte-binary flyte 2.0.51

1 of the 4 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8

Open the chart page →

4,982
flyte-coreflyte2.0.511 of 3See more

flyte-core flyte 2.0.51

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8

Open the chart page →

790
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.27

Open the chart page →

5,254
agentareaagentareaVerified publisher0.0.261 of 17See more

agentarea agentarea 0.0.26

1 of the 17 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:latest56360a626a00
next@16.3.6
16.3.8

Open the chart page →

16,661
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.8

Open the chart page →

2,508
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8

Open the chart page →

2,113
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8

Open the chart page →

1,257
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.27

Open the chart page →

3,282
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.8

Open the chart page →

1,637
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.8

Open the chart page →

841
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8

Open the chart page →

543
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
growthbook/growthbook:latest67b7cd7d12a1
next@16.3.5
16.3.8

Open the chart page →

1,589
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.31 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.3

1 of the 34 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8

Open the chart page →

24,860
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.8

Open the chart page →

9,862
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.27

Open the chart page →

6,104
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.27

Open the chart page →

13,135
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.8

Open the chart page →

21,601
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
next@15.0.1
15.5.27

Open the chart page →

16,773
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.8

Open the chart page →

1,477
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.27

Open the chart page →

4,871
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

648
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.8

Open the chart page →

2,240
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.27

Open the chart page →

3,224
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.27

Open the chart page →

735
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.27

Open the chart page →

3,005
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
next@15.5.24
15.5.27

Open the chart page →

4,250
dyff-frontenddyff-frontendVerified publisher0.21.01 of 1See more

dyff-frontend dyff-frontend 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-frontend:0.21.06418c3c0d24a
next@15.5.18
15.5.27

Open the chart page →

1,383
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8

Open the chart page →

3,775
flanksource-uiflanksourceVerified publisher1.4.3221 of 1See more

flanksource-ui flanksource 1.4.322

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.27

Open the chart page →

3,284
mission-controlflanksourceVerified publisher0.1.3391 of 8See more

mission-control flanksource 0.1.339

1 of the 8 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.27

Open the chart page →

10,966
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.8

Open the chart page →

15,493
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.27

Open the chart page →

664
bulwark-mailhelmforgeVerified publisher1.0.01 of 1See more

bulwark-mail helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.8

Open the chart page →

87
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.8

Open the chart page →

738
opencuthelmforgeVerified publisher1.1.111 of 5See more

opencut helmforge 1.1.11

1 of the 5 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.8

Open the chart page →

3,586
reactive-resumehelmforgeVerified publisher1.0.01 of 4See more

reactive-resume helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8

Open the chart page →

3,630
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.8

Open the chart page →

1,642
multicaicoretechVerified publisher0.6.21 of 4See more

multica icoretech 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/multica-ai/multica-web:v0.6.1cc8260b03716
next@16.3.4
16.3.8

Open the chart page →

2,436
kagentkagent0.10.31 of 6See more

kagent kagent 0.10.3

1 of the 6 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/ui:0.10.313f62914b66e
next@16.3.5
16.3.8

Open the chart page →

3,219
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-94543.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.27

Open the chart page →

3,906

Container images carrying it

78 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8
3
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.27
2
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.3.8
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.27
2
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
next@16.2.6
16.3.8
2
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8
2
agentarea/agentarea-frontend:latest56360a626a00
next@16.3.6
16.3.8
1
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.27
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.27
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.8
1
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.8
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.27
1
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
next@15.5.24
15.5.27
1
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.8
1
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.27
1
growthbook/growthbook:latest67b7cd7d12a1
next@16.3.5
16.3.8
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.8
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.8
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.8
1
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.8
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.27
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.8
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.27
1
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.27
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.8
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.27
1
sondresjo/altinnendata-app:v1.9.81c850e7bb963
next@16.3.6
16.3.8
1
sondresjo/nstuning-app:v1.6.1620805ad01071
next@16.3.6
16.3.8
1
sondresjo/pyttogpanne-app:v1.0.5e9a8d7e36e71
next@16.3.6
16.3.8
1
sondresjo/sjolystinnovation-app:v1.3.11a315219c9c2
next@16.3.6
16.3.8
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.8
1
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.8
1
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.5.27
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8
1
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.8
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.8
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.27
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
next@15.5.11
15.5.27
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.8
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.8
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.8
1
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
next@16.3.6
16.3.8
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.3.8
1
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.8
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.