StackRadar

GHSA-2464-fhr4-w9xw

Critical

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
128
of 18,232 indexed, latest versions
Container images
120
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Carried by container images the latest versions of 128 of 18,232 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
nextnpm11.0.1, 12.1.0, 12.1.6, 12.3.1+61 more15.5.28, 16.4.1120
OSV records
GHSA-2464-fhr4-w9xw

Charts affected

128 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.28

Open the chart page →

83,750
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
langgenius/dify-web:1.17.06a81fcdd82b5
next@16.3.2
16.4.1

Open the chart page →

64,010
homarrhomarr-labsOfficialVerified publisher8.37.01 of 1See more

homarr homarr-labs 8.37.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.7.0f532ce7cb2a3
next@16.3.6
16.4.1

Open the chart page →

218
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
next@16.2.6
16.4.1

Open the chart page →

3,643
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
next@14.2.13
15.5.28

Open the chart page →

89,811
homepagem0nsterrr-homepageVerified publisher5.6.01 of 1See more

homepage m0nsterrr-homepage 5.6.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.6.03e38fe788223
next@16.3.8
16.4.1

Open the chart page →

285
umamichristianhuthVerified publisher8.0.01 of 1See more

umami christianhuth 8.0.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.4.1

Open the chart page →

341
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
next@13.4.12
15.5.28

Open the chart page →

3,380
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
next@12.3.2
15.5.28

Open the chart page →

1,336
libredb-studiolibredb-studioOfficialVerified publisher0.1.1011 of 1See more

libredb-studio libredb-studio 0.1.101

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/libredb/libredb-studio:1.0.00cb0177dd278
next@16.4.0
16.4.1

Open the chart page →

1,463
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
next@12.3.4
15.5.28

Open the chart page →

15,146
umamihelmforgeVerified publisher2.4.21 of 3See more

umami helmforge 2.4.2

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.4.1

Open the chart page →

2,078
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.28

Open the chart page →

93,166
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.4.1

Open the chart page →

1,209
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
next@16.2.12
16.4.1

Open the chart page →

44,539
flyte-coreflyte2.0.521 of 3See more

flyte-core flyte 2.0.52

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
next@16.2.12
16.4.1

Open the chart page →

956
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
next@12.3.1
15.5.28

Open the chart page →

12,273
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
next@12.3.4
15.5.28

Open the chart page →

2,945
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.28

Open the chart page →

5,712
agentareaagentareaVerified publisher0.0.291 of 17See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:0.1.1066e740df4d7
next@16.3.8
16.4.1

Open the chart page →

12,660
seerrbdclark-helm-chartsVerified publisher0.1.61 of 1See more

seerr bdclark-helm-charts 0.1.6

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
next@16.2.6
16.4.1

Open the chart page →

2,370
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.4.1

Open the chart page →

2,370
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
next@11.0.1
15.5.28

Open the chart page →

3,614
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.4.1

Open the chart page →

1,390
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.28

Open the chart page →

3,483
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
next@14.1.0
15.5.28

Open the chart page →

22,981
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.4.1

Open the chart page →

1,660
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.4.1

Open the chart page →

868
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest534ba9902a37
next@14.3.0-canary.33
15.5.28

Open the chart page →

4,040
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.4.1

Open the chart page →

814
stackradarlockdepVerified publisher0.2.01 of 4See more

stackradar lockdep 0.2.0

1 of the 4 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-client:0.2.01ef6c7132778
next@16.4.0
16.4.1

Open the chart page →

5,899
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
growthbook/growthbook:latestdca716a7bf47
next@16.3.8
16.4.1

Open the chart page →

1,500
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.4.1

Open the chart page →

28,074
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
next@14.1.3
15.5.28

Open the chart page →

94,812
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.4.1

Open the chart page →

50,277
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
next@14.2.25
15.5.28

Open the chart page →

3,363
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
next@14.2.5
15.5.28

Open the chart page →

154,648
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.28

Open the chart page →

6,384
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.28

Open the chart page →

13,746
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.4.1

Open the chart page →

55,104
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
next@15.0.1
15.5.28

Open the chart page →

86,487
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
next@14.2.26
15.5.28

Open the chart page →

6,289
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.4.1

Open the chart page →

1,684
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
next@14.2.32
15.5.28

Open the chart page →

6,179
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.28

Open the chart page →

5,027
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest3e38fe788223
next@16.3.8
16.4.1

Open the chart page →

285
cliproxyapi-dashboardalekcVerified publisher0.1.21 of 1See more

cliproxyapi-dashboard alekc 0.1.2

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
next@16.1.6
16.4.1

Open the chart page →

586
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
next@14.2.4
15.5.28

Open the chart page →

3,718
katalogalpineworks0.1.21 of 5See more

katalog alpineworks 0.1.2

1 of the 5 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
next@14.1.4
15.5.28

Open the chart page →

5,945
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
fosrl/pangolin:latest17774ddbb4bf
next@16.3.5
16.4.1

Open the chart page →

2,355

Container images carrying it

120 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
next@12.3.1
15.5.28
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.4.1
3
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
next@16.2.6
16.4.1
3
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.4.1
3
sysnet4admin/dashboard:bluec5bd3bb1b5a6
next@14.2.3
15.5.28
2
ghcr.io/gethomepage/homepage:latest:v2.6.03e38fe788223
next@16.3.8
16.4.1
2
ghcr.io/libredb/libredb-studio:1.0.00cb0177dd278
next@16.4.0
16.4.1
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.28
2
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
next@16.2.12
16.4.1
2
agentarea/agentarea-frontend:0.1.1:latest066e740df4d7
next@16.3.8
16.4.1
1
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.28
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.28
1
chibisafe/chibisafe:latest534ba9902a37
next@14.3.0-canary.33
15.5.28
1
devopsiaci/self-learning-platform:1.3.18b295edf28f1c
next@16.3.8
16.4.1
1
documenso/documenso:v1.8.17f16a9449f18
next@14.2.6
15.5.28
1
drumsergio/lynxprompt:2.1.40e66bb00c2696
next@16.3.8
16.4.1
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.4.1
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.28
1
epam/ai-dial-admin-frontend:0.22.07bceacad3de2
next@15.5.27
15.5.28
1
ethpandaops/blobscan:latest7a9ab6370657
next@12.3.1
15.5.28
1
factly/mande-web:0.34.1742355964b0e
next@13.5.3
15.5.28
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
next@12.3.4
15.5.28
1
fallenbagel/jellyseerr:latest91edd5620e51
next@14.2.25
15.5.28
1
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
next@14.2.4
15.5.28
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
next@14.2.2
15.5.28
1
flanksource/incident-manager-ui:v1.4.3542bb089c79fc0
next@15.5.20
15.5.28
1
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.28
1
fosrl/pangolin:latest17774ddbb4bf
next@16.3.5
16.4.1
1
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.28
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.4.1
1
growthbook/growthbook:latestdca716a7bf47
next@16.3.8
16.4.1
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.4.1
1
kyso/kyso-front:lateste52595c5c16f
next@13.5.2
15.5.28
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.4.1
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.4.1
1
langgenius/dify-web:1.17.06a81fcdd82b5
next@16.3.2
16.4.1
1
langgenius/dify-web:0.6.11a2a294743634
next@14.1.0
15.5.28
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.28
1
langgenius/dify-web:1.0.0d64914ff0d6d
next@14.2.15
15.5.28
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.4.1
1
linuxserver/overseerr:1.35.06108ed066d4a
next@12.3.4
15.5.28
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.28
1
lsstsqre/squareone:0.4.09ded78e7fe03
next@11.0.1
15.5.28
1
lucassandin/welcome-client:latest48468b1ccd16
next@14.1.4
15.5.28
1
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.28
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
next@12.1.0
15.5.28
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
next@13.5.3
15.5.28
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.4.1
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.28
1
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.28
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.