StackRadar

GHSA-9qr9-h5gf-34mp

Critical

Advisory

Published 3 Dec 2025In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
10.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
15
of 17,781 indexed, latest versions
Container images
16
deployed by those charts
Fix available
1 of 1
affected package

Next.js is vulnerable to RCE in React flight protocol

Carried by container images the latest versions of 15 of 17,781 indexed charts deploy, on 16 images.

Affected packageAffected versionsFixed inImages
nextnpm15.2.3, 15.2.4, 15.3.1, 15.3.3+4 more15.2.6, 15.3.6, 15.4.8, 15.5.7+1 more16
OSV records
GHSA-9qr9-h5gf-34mp

Charts affected

15 by stars
ChartLatestAffected imagesRadar Score
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.2.6

Open the chart page →

28,839
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.4.8

Open the chart page →

30,816
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.0.7

Open the chart page →

1,505
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.3.6

Open the chart page →

5,213
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.2.6

Open the chart page →

11,532
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.2.6

Open the chart page →

2,759
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.2.6

Open the chart page →

2,529
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.3.6

Open the chart page →

666
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.3.6

Open the chart page →

24,400
neosyncneosyncVerified publisher0.5.411 of 3See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.3.6

Open the chart page →

7,184
appneosync-appVerified publisher0.5.411 of 1See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.3.6

Open the chart page →

1,569
alquimia-studioopenshift0.2.01 of 1See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.2.6

Open the chart page →

2,370
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.0.7

Open the chart page →

1,484
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.7

Open the chart page →

1,506
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry GHSA-9qr9-h5gf-34mp.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.2.6
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.2.6
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.2.6

Open the chart page →

6,994

Container images carrying it

16 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
next@15.3.1
15.3.6
2
alquimiaai/studio:certification38a1f0341982
next@15.2.4
15.2.6
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.2.6
1
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.4.8
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.3.6
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.2.6
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
next@15.3.4
15.3.6
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.2.6
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.0.7
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.3.6
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
next@15.5.4
15.5.7
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.2.6
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.2.6
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.2.6
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.0.7
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.2.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.