StackRadar

GHSA-2464-fhr4-w9xw

Critical

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
128
of 18,232 indexed, latest versions
Container images
120
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Carried by container images the latest versions of 128 of 18,232 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
nextnpm11.0.1, 12.1.0, 12.1.6, 12.3.1+61 more15.5.28, 16.4.1120
OSV records
GHSA-2464-fhr4-w9xw

Charts affected

128 by stars
ChartLatestAffected imagesRadar Score
modulariotmicroboxlabs0.11.12 of 4See more

modulariot microboxlabs 0.11.1

2 of the 4 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.4.1
ghcr.io/microboxlabs/miot-docs:latest893259699070
next@16.3.5
16.4.1

Open the chart page →

1,069
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-ui:middleware-test-0.0.787120a4561a9
next@12.1.6
15.5.28

Open the chart page →

12,082
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-ui:middleware-test-0.0.853772b7b42c7
next@12.1.6
15.5.28

Open the chart page →

12,071
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.28

Open the chart page →

4,271
neosyncneosyncVerified publisher0.5.411 of 3See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.28

Open the chart page →

8,885
appneosync-appVerified publisher0.5.411 of 1See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.28

Open the chart page →

1,709
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
next@14.2.4
15.5.28

Open the chart page →

6,160
alquimia-studioopenshift0.2.01 of 1See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.28

Open the chart page →

2,688
dify-enterpriseopenshift3.9.82 of 13See more

dify-enterprise openshift 3.9.8

2 of the 13 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.4.1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.4.1

Open the chart page →

9,820
console-webovrclk-20.1.11 of 1See more

console-web ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/akash-network/deploy-web:2.46.0ac540172c120
next@14.2.23
15.5.28

Open the chart page →

3,112
provider-consoleovrclk-20.1.01 of 1See more

provider-console ovrclk-2 0.1.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider-console:1.0.04d4c19a8d3ff
next@14.2.23
15.5.28

Open the chart page →

2,591
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.4.1

Open the chart page →

1,638
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.4.1

Open the chart page →

3,004
homepagequench-homepageVerified publisher0.0.121 of 1See more

homepage quench-homepage 0.0.12

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/homepagedigest-pinnede9d1b2799f06
next@16.3.8
16.4.1

Open the chart page →

78
kratos-selfservice-ui-noderadar-baseVerified publisher0.43.11 of 1See more

kratos-selfservice-ui-node radar-base 0.43.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
next@13.5.3
15.5.28

Open the chart page →

3,127
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.28

Open the chart page →

1,646
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.28

Open the chart page →

6,483
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.4.1

Open the chart page →

9,183
seerr-chartseerr-chartVerified publisher3.10.11 of 1See more

seerr-chart seerr-chart 3.10.1

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
next@16.2.6
16.4.1

Open the chart page →

2,212
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.28

Open the chart page →

5,381
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
supabase/studio:latestd878dcd9dba7
next@16.3.6
16.4.1

Open the chart page →

32,654
homepagethis-is-tobi-helm-chartsVerified publisher0.1.01 of 1See more

homepage this-is-tobi-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.4.1

Open the chart page →

779
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.28
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.28
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.28

Open the chart page →

9,644
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.4.1

Open the chart page →

795
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.28

Open the chart page →

3,550
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.28

Open the chart page →

4,316
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.28

Open the chart page →

6,439
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry GHSA-2464-fhr4-w9xw.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
next@14.1.4
15.5.28

Open the chart page →

1,682

Container images carrying it

120 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
next@12.3.1
15.5.28
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.4.1
3
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
next@16.2.6
16.4.1
3
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.4.1
3
sysnet4admin/dashboard:bluec5bd3bb1b5a6
next@14.2.3
15.5.28
2
ghcr.io/gethomepage/homepage:latest:v2.6.03e38fe788223
next@16.3.8
16.4.1
2
ghcr.io/libredb/libredb-studio:1.0.00cb0177dd278
next@16.4.0
16.4.1
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.28
2
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
next@16.2.12
16.4.1
2
agentarea/agentarea-frontend:0.1.1:latest066e740df4d7
next@16.3.8
16.4.1
1
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.28
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.28
1
chibisafe/chibisafe:latest534ba9902a37
next@14.3.0-canary.33
15.5.28
1
devopsiaci/self-learning-platform:1.3.18b295edf28f1c
next@16.3.8
16.4.1
1
documenso/documenso:v1.8.17f16a9449f18
next@14.2.6
15.5.28
1
drumsergio/lynxprompt:2.1.40e66bb00c2696
next@16.3.8
16.4.1
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.4.1
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.28
1
epam/ai-dial-admin-frontend:0.22.07bceacad3de2
next@15.5.27
15.5.28
1
ethpandaops/blobscan:latest7a9ab6370657
next@12.3.1
15.5.28
1
factly/mande-web:0.34.1742355964b0e
next@13.5.3
15.5.28
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
next@12.3.4
15.5.28
1
fallenbagel/jellyseerr:latest91edd5620e51
next@14.2.25
15.5.28
1
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
next@14.2.4
15.5.28
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
next@14.2.2
15.5.28
1
flanksource/incident-manager-ui:v1.4.3542bb089c79fc0
next@15.5.20
15.5.28
1
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
next@15.5.20
15.5.28
1
fosrl/pangolin:latest17774ddbb4bf
next@16.3.5
16.4.1
1
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.28
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.4.1
1
growthbook/growthbook:latestdca716a7bf47
next@16.3.8
16.4.1
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.4.1
1
kyso/kyso-front:lateste52595c5c16f
next@13.5.2
15.5.28
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.4.1
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.4.1
1
langgenius/dify-web:1.17.06a81fcdd82b5
next@16.3.2
16.4.1
1
langgenius/dify-web:0.6.11a2a294743634
next@14.1.0
15.5.28
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.28
1
langgenius/dify-web:1.0.0d64914ff0d6d
next@14.2.15
15.5.28
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.4.1
1
linuxserver/overseerr:1.35.06108ed066d4a
next@12.3.4
15.5.28
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.28
1
lsstsqre/squareone:0.4.09ded78e7fe03
next@11.0.1
15.5.28
1
lucassandin/welcome-client:latest48468b1ccd16
next@14.1.4
15.5.28
1
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.28
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
next@12.1.0
15.5.28
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
next@13.5.3
15.5.28
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.4.1
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.28
1
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.28
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.