StackRadar

GHSA-vcvr-r3jv-pc5j

Critical

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
49
of 17,966 indexed, latest versions
Container images
43
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Remote Code Execution in next/og ImageResponse

Carried by container images the latest versions of 49 of 17,966 indexed charts deploy, on 43 images.

Affected packageAffected versionsFixed inImages
nextnpm16.2.4, 16.2.6, 16.2.7, 16.2.9+9 more16.3.643
OSV records
GHSA-vcvr-r3jv-pc5j

Charts affected

49 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.6

Open the chart page →

71,370
homarrhomarr-labsOfficialVerified publisher8.29.21 of 1See more

homarr homarr-labs 8.29.2

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.6

Open the chart page →

634
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
next@16.2.6
16.3.6

Open the chart page →

3,440
homepagem0nsterrr-homepageVerified publisher5.4.01 of 1See more

homepage m0nsterrr-homepage 5.4.0

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.3.6

Open the chart page →

556
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.6

Open the chart page →

11,108
umamihelmforgeVerified publisher2.3.41 of 3See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.6

Open the chart page →

1,673
libredb-studiolibredb-studioOfficialVerified publisher0.1.721 of 1See more

libredb-studio libredb-studio 0.1.72

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/libredb/libredb-studio:0.17.0ce4d58724e25
next@16.3.5
16.3.6

Open the chart page →

1,237
flyte-binaryflyte2.0.501 of 4See more

flyte-binary flyte 2.0.50

1 of the 4 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.6

Open the chart page →

4,566
flyte-coreflyte2.0.501 of 3See more

flyte-core flyte 2.0.50

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.6

Open the chart page →

461
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.6

Open the chart page →

2,399
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
next@16.3.2
16.3.6

Open the chart page →

2,336
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.6

Open the chart page →

756
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.6

Open the chart page →

774
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.6

Open the chart page →

444
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
next@16.3.1
16.3.6

Open the chart page →

1,575
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.1

1 of the 34 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.6

Open the chart page →

23,320
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.6

Open the chart page →

9,505
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.6

Open the chart page →

20,099
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.6

Open the chart page →

1,307
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest643bd0be730d
next@16.3.3
16.3.6

Open the chart page →

556
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.6

Open the chart page →

2,131
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.6

Open the chart page →

3,381
garge-appgargeVerified publisher0.1.531 of 1See more

garge-app garge 0.1.53

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
sondresjo/garge-app:v1.22.0c4b8f096df6b
next@16.3.5
16.3.6

Open the chart page →

853
bulwark-mailhelmforgeVerified publisher1.0.01 of 1See more

bulwark-mail helmforge 1.0.0

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.6

Open the chart page →

10
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.6

Open the chart page →

634
reactive-resumehelmforgeVerified publisher1.0.01 of 4See more

reactive-resume helmforge 1.0.0

1 of the 4 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.6

Open the chart page →

3,100
multicaicoretechVerified publisher0.6.01 of 4See more

multica icoretech 0.6.0

1 of the 4 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/multica-ai/multica-web:v0.6.0b88402be269b
next@16.3.4
16.3.6

Open the chart page →

2,244
kagentkagent0.10.21 of 6See more

kagent kagent 0.10.2

1 of the 6 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/ui:0.10.2b966b0b0a97d
next@16.3.5
16.3.6

Open the chart page →

3,556
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.6

Open the chart page →

1,467
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.6

Open the chart page →

1,519
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.6

Open the chart page →

2,490
helm-pilotlbenicio-communityVerified publisher0.2.41 of 1See more

helm-pilot lbenicio-community 0.2.4

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.6

Open the chart page →

793
libredb-studiolibredb-studio-oci0.1.721 of 1See more

libredb-studio libredb-studio-oci 0.1.72

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/libredb/libredb-studio:0.17.0ce4d58724e25
next@16.3.5
16.3.6

Open the chart page →

1,237
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.6

Open the chart page →

1,887
homarrmedia-servarrVerified publisher0.55.31 of 1See more

homarr media-servarr 0.55.3

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.6

Open the chart page →

634
miot-appmicroboxlabs0.3.31 of 1See more

miot-app microboxlabs 0.3.3

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.6

Open the chart page →

593
miot-docsmicroboxlabs0.1.11 of 1See more

miot-docs microboxlabs 0.1.1

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-docs:latesta44f3a5045b5
next@16.3.5
16.3.6

Open the chart page →

268
miot-stackmicroboxlabs0.2.21 of 2See more

miot-stack microboxlabs 0.2.2

1 of the 2 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.6

Open the chart page →

593
modulariotmicroboxlabs0.11.02 of 4See more

modulariot microboxlabs 0.11.0

2 of the 4 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.6
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
next@16.3.5
16.3.6

Open the chart page →

2,440
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
onyxdotapp/onyx-web-server:latestec05c4275f8f
next@16.3.3
16.3.6

Open the chart page →

7,423
dify-enterpriseopenshift3.9.82 of 13See more

dify-enterprise openshift 3.9.8

2 of the 13 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.6
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.6

Open the chart page →

5,990
homepagequench-homepageVerified publisher0.0.41 of 1See more

homepage quench-homepage 0.0.4

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/homepagedigest-pinned2044e17671b8
next@16.3.3
16.3.6

Open the chart page →

73
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.6

Open the chart page →

6,932
seerr-chartseerr-chartVerified publisher3.10.01 of 1See more

seerr-chart seerr-chart 3.10.0

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
next@16.2.6
16.3.6

Open the chart page →

2,190
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.6

Open the chart page →

10,026
altinnendata-apptumogroup0.1.231 of 1See more

altinnendata-app tumogroup 0.1.23

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
sondresjo/altinnendata-app:v1.9.73150a3038fbf
next@16.3.5
16.3.6

Open the chart page →

853
nstuning-apptumogroup0.1.221 of 1See more

nstuning-app tumogroup 0.1.22

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
sondresjo/nstuning-app:v1.6.15b7cc8f543551
next@16.3.5
16.3.6

Open the chart page →

853
pyttogpanne-apptumogroup0.1.41 of 1See more

pyttogpanne-app tumogroup 0.1.4

1 of the 1 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
sondresjo/pyttogpanne-app:v1.0.3706b0218f7b4
next@16.3.5
16.3.6

Open the chart page →

853
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry GHSA-vcvr-r3jv-pc5j.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.3.6

Open the chart page →

570

Container images carrying it

43 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.6
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.6
3
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.3.6
2
ghcr.io/libredb/libredb-studio:0.17.0ce4d58724e25
next@16.3.5
16.3.6
2
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
next@16.2.6
16.3.6
2
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.6
2
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.6
1
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.6
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.6
1
growthbook/growthbook:latestcbf1bc59e9a9
next@16.3.1
16.3.6
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.6
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.6
1
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.6
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.6
1
onyxdotapp/onyx-web-server:latestec05c4275f8f
next@16.3.3
16.3.6
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.6
1
sondresjo/altinnendata-app:v1.9.73150a3038fbf
next@16.3.5
16.3.6
1
sondresjo/garge-app:v1.22.0c4b8f096df6b
next@16.3.5
16.3.6
1
sondresjo/nstuning-app:v1.6.15b7cc8f543551
next@16.3.5
16.3.6
1
sondresjo/pyttogpanne-app:v1.0.3706b0218f7b4
next@16.3.5
16.3.6
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.6
1
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.6
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.6
1
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.6
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.6
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.6
1
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
next@16.3.2
16.3.6
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.3.6
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.6
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.6
1
ghcr.io/kagent-dev/kagent/ui:0.10.2b966b0b0a97d
next@16.3.5
16.3.6
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.6
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.6
1
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
next@16.3.5
16.3.6
1
ghcr.io/microboxlabs/miot-docs:latesta44f3a5045b5
next@16.3.5
16.3.6
1
ghcr.io/multica-ai/multica-web:v0.6.0b88402be269b
next@16.3.4
16.3.6
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.6
1
ghcr.io/quenchworks/images/homepage2044e17671b8
next@16.3.3
16.3.6
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.6
1
ghcr.io/seerr-team/seerr:v3.5.027602401178d
next@16.2.6
16.3.6
1
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.6
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.6
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.6
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.