StackRadar

GHSA-2xp9-vwfh-vxw4

Critical

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
110
of 17,781 indexed, latest versions
Container images
105
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Carried by container images the latest versions of 110 of 17,781 indexed charts deploy, on 105 images.

Affected packageAffected versionsFixed inImages
nextnpm11.0.1, 12.1.0, 12.1.6, 12.3.1+56 more15.5.24, 16.3.3105
OSV records
GHSA-2xp9-vwfh-vxw4

Charts affected

110 by stars
ChartLatestAffected imagesRadar Score
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.24

Open the chart page →

1,506
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.24

Open the chart page →

5,338
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.3

Open the chart page →

5,819
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.3

Open the chart page →

1,991
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.24

Open the chart page →

4,820
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
supabase/studio:latest94a2a9d2906e
next@16.2.11
16.3.3

Open the chart page →

9,556
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.24
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.24
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.24

Open the chart page →

6,994
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.24

Open the chart page →

2,789
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.24

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.24

Open the chart page →

5,984

Container images carrying it

105 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
next@14.1.1
15.5.24
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.5.24
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
next@13.4.12
15.5.24
1
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
next@13.4.12
15.5.24
1
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.24
1
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
next@14.1.4
15.5.24
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.3
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.3
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.24
1
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
next@16.3.2
16.3.3
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
next@14.2.25
15.5.24
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.3
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.3
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.3
1
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
next@16.3.0-preview.9
16.3.3
1
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
next@16.3.0-preview.9
16.3.3
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.3.3
1
ghcr.io/kagent-dev/kagent/ui:0.10.12c4de55d3ffe
next@16.2.12
16.3.3
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.24
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.3
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.24
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.24
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.3
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.24
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
next@13.5.6
15.5.24
1
ghcr.io/microboxlabs/miot-docs:lateste09d92c61f43
next@16.2.11
16.3.3
1
ghcr.io/middleware-labs/odigos-ui:middleware-test-0.0.787120a4561a9
next@12.1.6
15.5.24
1
ghcr.io/middleware-labs/vision-ui:middleware-test-0.0.853772b7b42c7
next@12.1.6
15.5.24
1
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.24
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
next@14.2.4
15.5.24
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
next@14.2.5
15.5.24
1
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
next@16.2.10
16.3.3
1
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
next@14.2.5
15.5.24
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.24
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.3
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
next@11.0.1
15.5.24
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
next@12.3.4
15.5.24
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
next@14.2.35
15.5.24
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.24
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.24
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.24
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.24
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
next@12.3.2
15.5.24
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.24
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.3
1
ghcr.io/umami-software/umami:3.3.1fa32d116cf20
next@16.3.0
16.3.3
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.3
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.24
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.3
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.24
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.