StackRadar

GHSA-2xp9-vwfh-vxw4

Critical

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
110
of 17,781 indexed, latest versions
Container images
105
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Carried by container images the latest versions of 110 of 17,781 indexed charts deploy, on 105 images.

Affected packageAffected versionsFixed inImages
nextnpm11.0.1, 12.1.0, 12.1.6, 12.3.1+56 more15.5.24, 16.3.3105
OSV records
GHSA-2xp9-vwfh-vxw4

Charts affected

110 by stars
ChartLatestAffected imagesRadar Score
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.24

Open the chart page →

1,506
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
next@14.2.25
15.5.24

Open the chart page →

5,338
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.3

Open the chart page →

5,819
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.3

Open the chart page →

1,991
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
next@13.0.7
15.5.24

Open the chart page →

4,820
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
supabase/studio:latest94a2a9d2906e
next@16.2.11
16.3.3

Open the chart page →

9,556
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.24
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.24
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.24

Open the chart page →

6,994
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
next@13.5.11
15.5.24

Open the chart page →

2,789
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
next@13.2.4
15.5.24

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-2xp9-vwfh-vxw4.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.24

Open the chart page →

5,984

Container images carrying it

105 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
next@12.3.1
15.5.24
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.3
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
next@16.2.6
16.3.3
3
sysnet4admin/dashboard:bluec5bd3bb1b5a6
next@14.2.3
15.5.24
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.5.24
2
ghcr.io/unionai-oss/flyteconsole-v2:latestdb4362ec0d3b
next@16.2.12
16.3.3
2
agentarea/agentarea-frontend:latest2098a9d7b1fe
next@16.2.11
16.3.3
1
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.5.24
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.24
1
chibisafe/chibisafe:latest836467a50792
next@14.3.0-canary.33
15.5.24
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.3
1
documenso/documenso:v1.8.17f16a9449f18
next@14.2.6
15.5.24
1
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.3
1
drumsergio/pumperly:1.4.885bbc3915e9e
next@16.2.2
16.3.3
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.24
1
epam/ai-dial-admin-frontend:0.20.021d91ad74755
next@15.5.21
15.5.24
1
epam/ai-dial-chat:0.49.0bd6b13695cdc
next@16.3.0
16.3.3
1
ethpandaops/blobscan:latest7a9ab6370657
next@12.3.1
15.5.24
1
factly/mande-web:0.34.1742355964b0e
next@13.5.3
15.5.24
1
fallenbagel/jellyseerr:latest4538137bc5af
next@14.2.25
15.5.24
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
next@12.3.4
15.5.24
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
next@14.2.2
15.5.24
1
flanksource/incident-manager-ui:v1.4.318891f21df54fb
next@15.5.20
15.5.24
1
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.24
1
growthbook/growthbook:5.0.1f53ead646b5f
next@16.3.1
16.3.3
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.3
1
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.5.24
1
kyso/kyso-front:lateste52595c5c16f
next@13.5.2
15.5.24
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.3
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.3
1
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.3
1
langgenius/dify-web:0.6.11a2a294743634
next@14.1.0
15.5.24
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.24
1
langgenius/dify-web:1.0.0d64914ff0d6d
next@14.2.15
15.5.24
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.3
1
linuxserver/overseerr:1.35.06108ed066d4a
next@12.3.4
15.5.24
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.24
1
lsstsqre/squareone:0.4.09ded78e7fe03
next@11.0.1
15.5.24
1
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.24
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
next@12.1.0
15.5.24
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
next@13.5.3
15.5.24
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.3
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.24
1
sigp/siren:v3.0.42c219b04758e
next@14.2.25
15.5.24
1
supabase/studio:20241021-9f9b08326d8070c55e9
next@14.2.13
15.5.24
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.3
1
supabase/studio:latest94a2a9d2906e
next@16.2.11
16.3.3
1
treskon/portrait-ui:DEV-lateste7970783bc8d
next@14.1.3
15.5.24
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
next@14.2.26
15.5.24
1
wsjbr/duplistatus:1.4.25e594f5f09f6
next@16.2.9
16.3.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.