StackRadarChart IndexLive demo

CVE-2026-94544

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026

Severity: Medium; worst across findings
CVSS: 4.2; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 27; of 18,053 indexed, latest versions
Container images: 26; deployed by those charts
Fix available: 1 of 1; affected package

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Carried by container images the latest versions of 27 of 18,053 indexed charts deploy, on 26 images.

Affected package	Affected versions	Fixed in	Images
nextnpm	16.3.0, 16.3.1, 16.3.3, 16.3.4+2 more	16.3.8	26

OSV records: GHSA-3w37-wq28-93x7

Charts affected

27 by stars

Chart

Latest

Affected images

Radar Score

homarrhomarr-labs

1 of 1 See more

homarr homarr-labs 8.32.0

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/homarr-labs/homarr :v2.2.0	1b4ea544e267	next@16.3.6	16.3.8

Open the chart page →

420

homepagem0nsterrr-homepage

1 of 1 See more

homepage m0nsterrr-homepage 5.4.0

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :v2.4.0	643bd0be730d	next@16.3.3	16.3.8

Open the chart page →

648

umamihelmforge

1 of 3 See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.4.0	85909afc45bd	next@16.3.4	16.3.8

Open the chart page →

1,997

duplistatusduplistatus

1 of 2 See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
wsjbr/duplistatus :1.5.0	bede86cf183f	next@16.3.6	16.3.8

Open the chart page →

1,080

agentareaagentarea

1 of 17 See more

agentarea agentarea 0.0.26

1 of the 17 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
agentarea/agentarea-frontend :latest	56360a626a00	next@16.3.6	16.3.8

Open the chart page →

16,661

claude-code-hubclaude-code-hub

1 of 4 See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/ding113/claude-code-hub :latest	fa7c6f5428c2	next@16.3.3	16.3.8

Open the chart page →

2,113

growthbookgrowthbook

1 of 2 See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
growthbook/growthbook :5.1.0	c8a124f55dca	next@16.3.5	16.3.8

Open the chart page →

1,257

lakilaki

1 of 2 See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/laki-n/laki-ui :v1.6.0	e51253617271	next@16.3.0	16.3.8

Open the chart page →

543

growthbookone-acre-fund

1 of 3 See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
growthbook/growthbook :latest	67b7cd7d12a1	next@16.3.5	16.3.8

Open the chart page →

1,589

opentelemetry-demoopentelemetry-helm

1 of 34 See more

opentelemetry-demo opentelemetry-helm 0.42.3

1 of the 34 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :3.1.0-frontend	28358db46206	next@16.3.5	16.3.8

Open the chart page →

24,860

homepagealareira

1 of 1 See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :latest	643bd0be730d	next@16.3.3	16.3.8

Open the chart page →

648

1 of 1 See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
fosrl/pangolin :latest	00cfb631097a	next@16.3.5	16.3.8

Open the chart page →

2,240

fauxgpufauxgpu

1 of 4 See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/devops-dojo7/fauxgpu/web :0.2.4	691dd15d6bca	next@16.3.1	16.3.8

Open the chart page →

3,775

bulwark-mailhelmforge

1 of 1 See more

bulwark-mail helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/bulwarkmail/webmail :1.11.2-always	0d48c66f993f	next@16.3.3	16.3.8

Open the chart page →

87

reactive-resumehelmforge

1 of 4 See more

reactive-resume helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/amruthpillai/reactive-resume :v5.3.0	c487ec5edcfe	next@16.3.0	16.3.8

Open the chart page →

3,630

multicaicoretech

1 of 4 See more

multica icoretech 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/multica-ai/multica-web :v0.6.1	cc8260b03716	next@16.3.4	16.3.8

Open the chart page →

2,436

kagentkagent

1 of 6 See more

kagent kagent 0.10.3

1 of the 6 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/kagent-dev/kagent/ui :0.10.3	13f62914b66e	next@16.3.5	16.3.8

Open the chart page →

3,219

miot-docsmicroboxlabs

1 of 1 See more

miot-docs microboxlabs 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/microboxlabs/miot-docs :latest	b528e6a1d9d5	next@16.3.5	16.3.8

Open the chart page →

284

modulariotmicroboxlabs

1 of 4 See more

modulariot microboxlabs 0.11.0

1 of the 4 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/microboxlabs/miot-docs :latest	84877c693d8a	next@16.3.5	16.3.8

Open the chart page →

2,626

pumperlypumperly

1 of 3 See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
drumsergio/pumperly :1.17.0	f7efe5fc03f3	next@16.3.6	16.3.8

Open the chart page →

2,800

homepagequench-homepage

1 of 1 See more

homepage quench-homepage 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/quenchworks/images/homepagedigest-pinned	b63a85533463	next@16.3.6	16.3.8

Open the chart page →

90

supabaseteochenglim

1 of 13 See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
supabase/studio :latest	fdb56cfa1705	next@16.3.5	16.3.8

Open the chart page →

10,744

altinnendata-apptumogroup

1 of 1 See more

altinnendata-app tumogroup 0.1.24

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
sondresjo/altinnendata-app :v1.9.8	1c850e7bb963	next@16.3.6	16.3.8

Open the chart page →

931

nstuning-apptumogroup

1 of 1 See more

nstuning-app tumogroup 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
sondresjo/nstuning-app :v1.6.16	20805ad01071	next@16.3.6	16.3.8

Open the chart page →

931

pyttogpanne-apptumogroup

1 of 1 See more

pyttogpanne-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
sondresjo/pyttogpanne-app :v1.0.5	e9a8d7e36e71	next@16.3.6	16.3.8

Open the chart page →

931

sjolystinnovation-apptumogroup

1 of 1 See more

sjolystinnovation-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
sondresjo/sjolystinnovation-app :v1.3.1	1a315219c9c2	next@16.3.6	16.3.8

Open the chart page →

931

homepageunknowniq

1 of 2 See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-94544.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :v2.2.0	753eeb0cc22a	next@16.3.3	16.3.8

Open the chart page →

662

Container images carrying it

26 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/gethomepage/homepage :latest :v2.4.0	643bd0be730d	next@16.3.3	16.3.8	2
agentarea/agentarea-frontend :latest	56360a626a00	next@16.3.6	16.3.8	1
drumsergio/pumperly :1.17.0	f7efe5fc03f3	next@16.3.6	16.3.8	1
fosrl/pangolin :latest	00cfb631097a	next@16.3.5	16.3.8	1
growthbook/growthbook :latest	67b7cd7d12a1	next@16.3.5	16.3.8	1
growthbook/growthbook :5.1.0	c8a124f55dca	next@16.3.5	16.3.8	1
sondresjo/altinnendata-app :v1.9.8	1c850e7bb963	next@16.3.6	16.3.8	1
sondresjo/nstuning-app :v1.6.16	20805ad01071	next@16.3.6	16.3.8	1
sondresjo/pyttogpanne-app :v1.0.5	e9a8d7e36e71	next@16.3.6	16.3.8	1
sondresjo/sjolystinnovation-app :v1.3.1	1a315219c9c2	next@16.3.6	16.3.8	1
supabase/studio :latest	fdb56cfa1705	next@16.3.5	16.3.8	1
wsjbr/duplistatus :1.5.0	bede86cf183f	next@16.3.6	16.3.8	1
ghcr.io/amruthpillai/reactive-resume :v5.3.0	c487ec5edcfe	next@16.3.0	16.3.8	1
ghcr.io/bulwarkmail/webmail :1.11.2-always	0d48c66f993f	next@16.3.3	16.3.8	1
ghcr.io/devops-dojo7/fauxgpu/web :0.2.4	691dd15d6bca	next@16.3.1	16.3.8	1
ghcr.io/ding113/claude-code-hub :latest	fa7c6f5428c2	next@16.3.3	16.3.8	1
ghcr.io/gethomepage/homepage :latest :v2.2.0	753eeb0cc22a	next@16.3.3	16.3.8	1
ghcr.io/homarr-labs/homarr :v2.2.0	1b4ea544e267	next@16.3.6	16.3.8	1
ghcr.io/kagent-dev/kagent/ui :0.10.3	13f62914b66e	next@16.3.5	16.3.8	1
ghcr.io/laki-n/laki-ui :v1.6.0	e51253617271	next@16.3.0	16.3.8	1
ghcr.io/microboxlabs/miot-docs :latest	84877c693d8a	next@16.3.5	16.3.8	1
ghcr.io/microboxlabs/miot-docs :latest	b528e6a1d9d5	next@16.3.5	16.3.8	1
ghcr.io/multica-ai/multica-web :v0.6.1	cc8260b03716	next@16.3.4	16.3.8	1
ghcr.io/open-telemetry/demo :3.1.0-frontend	28358db46206	next@16.3.5	16.3.8	1
ghcr.io/quenchworks/images/homepage	b63a85533463	next@16.3.6	16.3.8	1
ghcr.io/umami-software/umami :3.4.0	85909afc45bd	next@16.3.4	16.3.8	1