StackRadarChart IndexLive demo

GHSA-w37m-7fhw-fmv9

Medium

Advisory

Published 11 Dec 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 19; of 17,781 indexed, latest versions
Container images: 20; deployed by those charts
Fix available: 1 of 1; affected package

Next Server Actions Source Code Exposure

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 20 images.

Affected package	Affected versions	Fixed in	Images
nextnpm	15.2.3, 15.2.4, 15.3.1, 15.3.3+6 more	15.2.7, 15.3.7, 15.4.9, 15.5.8+1 more	20

OSV records: GHSA-w37m-7fhw-fmv9

Charts affected

19 by stars

Chart

Latest

Affected images

Radar Score

difydouban

1 of 6 See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
langgenius/dify-web :1.10.1-fix.1	c306ac577912	next@15.5.7	15.5.8

Open the chart page →

19,391

umamichristianhuth

1 of 2 See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.8

Open the chart page →

2,367

cosmocosmo-platform

1 of 10 See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.2.7

Open the chart page →

28,839

coreinstill-ai

1 of 15 See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
instill/console :0.68.5	4cd70e2df5c6	next@15.4.7	15.4.9

Open the chart page →

30,816

kube-ingress-dash-chartkube-ingress-dash

1 of 1 See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.0.9

Open the chart page →

1,505

karakeepself-hosters-by-night

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	next@15.3.3	15.3.7

Open the chart page →

5,213

vuiseriohub

1 of 3 See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
dserio83/velero-ui :0.3.1	b4e1ec6664d3	next@15.2.3	15.2.7

Open the chart page →

11,532

kamaji-consoleclastix

1 of 1 See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	next@15.2.3	15.2.7

Open the chart page →

2,759

desishowbiz-frontenddesishowbiz

1 of 1 See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
rahulbhiwagade122/desishowbiz :latest	08490b70998c	next@15.2.4	15.2.7

Open the chart page →

2,529

lobe-chathelm-charts-darox

1 of 1 See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next@15.3.4	15.3.7

Open the chart page →

666

pangolinkrzwiatrzyk

1 of 1 See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
fosrl/pangolin :1.13.0	c32ad797ab96	next@15.5.7	15.5.8

Open the chart page →

3,441

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
apecloud/aperag-frontend :v0.0.0-nightly	b3ae37840ace	next@15.4.8	15.4.9

Open the chart page →

8,405

magistralamagistrala-devops

1 of 42 See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.3.7

Open the chart page →

24,400

neosyncneosync

1 of 3 See more

neosync neosync 0.5.41

1 of the 3 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.3.7

Open the chart page →

7,184

appneosync-app

1 of 1 See more

app neosync-app 0.5.41

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.3.7

Open the chart page →

1,569

alquimia-studioopenshift

1 of 1 See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.2.7

Open the chart page →

2,370

podscopepodscope

1 of 1 See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.0.9

Open the chart page →

1,484

radar-self-enrolment-uiradar-base

1 of 1 See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.8

Open the chart page →

1,506

saleor-appstrieb-work

3 of 5 See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry GHSA-w37m-7fhw-fmv9.

Container image	Digest	Package	Fixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.2.7
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.2.7
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.2.7

Open the chart page →

6,994

Container images carrying it

20 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	next@15.3.1	15.3.7	2
alquimiaai/studio :certification	38a1f0341982	next@15.2.4	15.2.7	1
apecloud/aperag-frontend :v0.0.0-nightly	b3ae37840ace	next@15.4.8	15.4.9	1
dserio83/velero-ui :0.3.1	b4e1ec6664d3	next@15.2.3	15.2.7	1
fosrl/pangolin :1.13.0	c32ad797ab96	next@15.5.7	15.5.8	1
instill/console :0.68.5	4cd70e2df5c6	next@15.4.7	15.4.9	1
langgenius/dify-web :1.10.1-fix.1	c306ac577912	next@15.5.7	15.5.8	1
lobehub/lobe-chat :1.96.9	da0c21fefcd3	next@15.3.4	15.3.7	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	next@15.2.4	15.2.7	1
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	next@15.3.4	15.3.7	1
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	next@15.2.3	15.2.7	1
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.0.9	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	next@15.3.3	15.3.7	1
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.8	1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.2.7	1
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.2.7	1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.2.7	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.8	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.0.9	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.2.7	1