StackRadar

GHSA-673q-mjm6-r5xr

Critical

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
55
of 18,232 indexed, latest versions
Container images
48
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

Carried by container images the latest versions of 55 of 18,232 indexed charts deploy, on 48 images.

Affected packageAffected versionsFixed inImages
nextnpm16.0.3, 16.0.10, 16.1.3, 16.1.6+15 more16.4.148
OSV records
GHSA-673q-mjm6-r5xr

Charts affected

55 by stars
ChartLatestAffected imagesRadar Score
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry GHSA-673q-mjm6-r5xr.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.4.1

Open the chart page →

9,183
seerr-chartseerr-chartVerified publisher3.10.11 of 1See more

seerr-chart seerr-chart 3.10.1

1 of the 1 container images this version deploys carry GHSA-673q-mjm6-r5xr.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
next@16.2.6
16.4.1

Open the chart page →

2,212
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-673q-mjm6-r5xr.

Container imageDigestPackageFixed in
supabase/studio:latestd878dcd9dba7
next@16.3.6
16.4.1

Open the chart page →

32,654
homepagethis-is-tobi-helm-chartsVerified publisher0.1.01 of 1See more

homepage this-is-tobi-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-673q-mjm6-r5xr.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.4.1

Open the chart page →

779
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry GHSA-673q-mjm6-r5xr.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.4.1

Open the chart page →

795

Container images carrying it

48 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.4.1
3
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
next@16.2.6
16.4.1
3
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.4.1
3
ghcr.io/gethomepage/homepage:latest:v2.6.03e38fe788223
next@16.3.8
16.4.1
2
ghcr.io/libredb/libredb-studio:1.0.00cb0177dd278
next@16.4.0
16.4.1
2
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
next@16.2.12
16.4.1
2
agentarea/agentarea-frontend:0.1.1:latest066e740df4d7
next@16.3.8
16.4.1
1
devopsiaci/self-learning-platform:1.3.18b295edf28f1c
next@16.3.8
16.4.1
1
drumsergio/lynxprompt:2.1.40e66bb00c2696
next@16.3.8
16.4.1
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.4.1
1
fosrl/pangolin:latest17774ddbb4bf
next@16.3.5
16.4.1
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.4.1
1
growthbook/growthbook:latestdca716a7bf47
next@16.3.8
16.4.1
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.4.1
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.4.1
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.4.1
1
langgenius/dify-web:1.17.06a81fcdd82b5
next@16.3.2
16.4.1
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.4.1
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.4.1
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.4.1
1
supabase/studio:latestd878dcd9dba7
next@16.3.6
16.4.1
1
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.4.1
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.4.1
1
ghcr.io/bulwarkmail/webmail:1.15.0-always6345944b2cba
next@16.3.8
16.4.1
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.4.1
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.4.1
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.4.1
1
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.4.1
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.4.1
1
ghcr.io/gethomepage/homepage:v1.13.2a0b71c8e7572
next@16.2.6
16.4.1
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.4.1
1
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
next@16.3.6
16.4.1
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.4.1
1
ghcr.io/homarr-labs/homarr:v2.7.0f532ce7cb2a3
next@16.3.6
16.4.1
1
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
next@16.1.6
16.4.1
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.4.1
1
ghcr.io/kagent-dev/kagent/ui:0.10.4a6edf70c6e8e
next@16.3.5
16.4.1
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.4.1
1
ghcr.io/lockdep/stackradar-client:0.2.01ef6c7132778
next@16.4.0
16.4.1
1
ghcr.io/microboxlabs/miot-docs:latest893259699070
next@16.3.5
16.4.1
1
ghcr.io/microboxlabs/miot-docs:latestd3431480deea
next@16.3.5
16.4.1
1
ghcr.io/multica-ai/multica-web:v0.6.5f38d02584705
next@16.3.8
16.4.1
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.4.1
1
ghcr.io/quenchworks/images/homepagee9d1b2799f06
next@16.3.8
16.4.1
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.4.1
1
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
next@16.2.6
16.4.1
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.4.1
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.4.1
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.