StackRadar

GHSA-2xp9-vwfh-vxw4

Critical

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
110
of 17,781 indexed, latest versions
Container images
105
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Carried by container images the latest versions of 110 of 17,781 indexed charts deploy, on 105 images.

Affected packageAffected versionsFixed inImages
nextnpm11.0.1, 12.1.0, 12.1.6, 12.3.1+56 more15.5.24, 16.3.3105
OSV records
GHSA-2xp9-vwfh-vxw4

Charts affected

110 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.24

Open the chart page →

19,391
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.3

Open the chart page →

22,002
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
next@16.2.6
16.3.3

Open the chart page →

3,004
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
next@14.2.13
15.5.24

Open the chart page →

23,123
umamichristianhuthVerified publisher7.13.01 of 2See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.24

Open the chart page →

2,367
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
next@13.4.12
15.5.24

Open the chart page →

2,581
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
next@12.3.2
15.5.24

Open the chart page →

1,255
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
next@12.3.4
15.5.24

Open the chart page →

14,238
dialdialOfficialVerified publisher7.2.01 of 4See more

dial dial 7.2.0

1 of the 4 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
epam/ai-dial-chat:0.49.0bd6b13695cdc
next@16.3.0
16.3.3

Open the chart page →

2,163
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.3

Open the chart page →

9,460
umamihelmforgeVerified publisher2.3.31 of 3See more

umami helmforge 2.3.3

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.3.1fa32d116cf20
next@16.3.0
16.3.3

Open the chart page →

2,027
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.24

Open the chart page →

28,839
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
next@16.2.9
16.3.3

Open the chart page →

1,870
flyte-binaryflyte2.0.481 of 4See more

flyte-binary flyte 2.0.48

1 of the 4 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestdb4362ec0d3b
next@16.2.12
16.3.3

Open the chart page →

4,641
flyte-coreflyte2.0.481 of 3See more

flyte-core flyte 2.0.48

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestdb4362ec0d3b
next@16.2.12
16.3.3

Open the chart page →

1,178
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
next@12.3.1
15.5.24

Open the chart page →

10,311
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.5.24

Open the chart page →

30,816
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
next@12.3.4
15.5.24

Open the chart page →

2,702
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.24

Open the chart page →

4,016
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:latest2098a9d7b1fe
next@16.2.11
16.3.3

Open the chart page →

14,914
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.3

Open the chart page →

1,991
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
next@16.3.2
16.3.3

Open the chart page →

2,173
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
next@11.0.1
15.5.24

Open the chart page →

3,444
growthbookgrowthbook5.0.11 of 2See more

growthbook growthbook 5.0.1

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
growthbook/growthbook:5.0.1f53ead646b5f
next@16.3.1
16.3.3

Open the chart page →

709
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.24

Open the chart page →

2,770
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
next@14.1.0
15.5.24

Open the chart page →

20,403
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.3

Open the chart page →

1,505
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.3

Open the chart page →

800
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest836467a50792
next@14.3.0-canary.33
15.5.24

Open the chart page →

5,654
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.3

Open the chart page →

394
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
next@16.2.10
16.3.3

Open the chart page →

22,420
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
next@14.1.3
15.5.24

Open the chart page →

31,844
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.3

Open the chart page →

8,158
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
next@14.2.25
15.5.24

Open the chart page →

2,823
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
next@14.2.5
15.5.24

Open the chart page →

30,234
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.24

Open the chart page →

5,213
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.24

Open the chart page →

11,532
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.3

Open the chart page →

18,075
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
next@14.2.26
15.5.24

Open the chart page →

5,225
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.3

Open the chart page →

1,269
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
next@14.2.32
15.5.24

Open the chart page →

10,090
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
next@15.5.21
15.5.24

Open the chart page →

3,820
katalogalpineworks0.1.21 of 5See more

katalog alpineworks 0.1.2

1 of the 5 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
next@14.1.4
15.5.24

Open the chart page →

4,497
overseerrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

overseerr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
linuxserver/overseerr:1.35.06108ed066d4a
next@12.3.4
15.5.24

Open the chart page →

3,071
chatgpt-next-webchatgpt-next-web0.1.11 of 1See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
next@14.1.1
15.5.24

Open the chart page →

1,977
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.24

Open the chart page →

2,759
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.24

Open the chart page →

551
homarrdelerVerified publisher1.0.11 of 1See more

homarr deler 1.0.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
next@13.4.12
15.5.24

Open the chart page →

1,924
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.24

Open the chart page →

2,529
dial-admindialVerified publisher0.18.01 of 3See more

dial-admin dial 0.18.0

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.20.021d91ad74755
next@15.5.21
15.5.24

Open the chart page →

4,046

Container images carrying it

105 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
next@14.2.5
15.5.24
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
next@15.5.20
15.5.24
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.24
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
next@14.2.32
15.5.24
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
next@15.5.18
15.5.24
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.