Skip to content

[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44 #51329

Closed
Closed
[container-image-scan] Container findings for ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44#51329
Assignees
pelikhancopilot-swe-agent
Labels
cookieIssue Monster Loves Cookies!security

Description

@github-actions
github-actions
bot
opened on Aug 8, 2026

Summary

Image: ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44
Pinned reference: ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44@sha256:b50fbadba138f6e9aba94aca09711335c489bb3b15861220cb66f6092e042dc7

  • Vulnerabilities: 4 High, 2 Low, 13 Medium (0 Critical)
  • License policy violations: 35

Vulnerabilities

19 unique vulnerability findings (severity, ID, package@version, fix, reference) 
[High] CVE-2026-58043: node@22.23.1 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
[High] GHSA-mh99-v99m-4gvg: brace-expansion@5.0.7 (fix: 5.0.8) (https://github.com/advisories/GHSA-mh99-v99m-4gvg)
[High] GHSA-mwp4-54f8-5fhr: ip-address@10.2.0 (fix: 10.3.1) (https://github.com/advisories/GHSA-mwp4-54f8-5fhr)
[High] GHSA-rgw5-rvv9-x895: brace-expansion@5.0.7 (fix: 5.0.9) (https://github.com/advisories/GHSA-rgw5-rvv9-x895)
[Low] CVE-2026-56847: node@22.23.1 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
[Low] CVE-2026-58039: node@22.23.1 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: busybox-binsh@1.37.0-r31 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: busybox@1.37.0-r31 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: ssl_client@1.37.0-r31 ((nvd.nist.gov/redacted)
[Medium] CVE-2026-56850: node@22.23.1 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
[Medium] CVE-2026-58040: node@22.23.1 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
[Medium] CVE-2026-58055: nghttp2-libs@1.69.0-r0 ((nvd.nist.gov/redacted)
[Medium] GHSA-22jq-vg5j-6vgg: ip-address@10.2.0 (fix: 10.2.1) (https://github.com/advisories/GHSA-22jq-vg5j-6vgg)
[Medium] GHSA-4xrf-jv44-h6hh: ip-address@10.2.0 (fix: 10.2.2) (https://github.com/advisories/GHSA-4xrf-jv44-h6hh)
[Medium] GHSA-8988-4f7v-96qf: `@opentelemetry/core`@1.30.1 (fix: 2.8.0) (https://github.com/advisories/GHSA-8988-4f7v-96qf)
[Medium] GHSA-8xcm-r25x-g524: undici@6.27.0 (fix: 6.28.0) (https://github.com/advisories/GHSA-8xcm-r25x-g524)
[Medium] GHSA-m8rv-5g2x-5cg5: undici@6.27.0 (fix: 6.28.0) (https://github.com/advisories/GHSA-m8rv-5g2x-5cg5)
[Medium] GHSA-r292-9mhp-454m: tar@7.5.19 (fix: 7.5.21) (https://github.com/advisories/GHSA-r292-9mhp-454m)
[Medium] GHSA-v3r7-h72x-cjcm: undici@6.27.0 (fix: 6.28.0) (https://github.com/advisories/GHSA-v3r7-h72x-cjcm)

Licenses

35 license policy violations 
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: lru-cache@11.5.1 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: busybox-binsh@1.37.0-r31 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: minipass@7.1.3 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: chownr@3.0.0 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: tar@7.5.19 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: path-scurry@2.0.2 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: node@22.23.1 (no licenses found)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: libidn2@2.3.8-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: apk-tools@3.0.6-r0 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: ssl_client@1.37.0-r31 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: libunistring@1.4.2-r0 (GPL-2.0-or-later, LGPL-3.0-or-later)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: awf-api-proxy@1.0.0 (no licenses found)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: spdx-license-ids@3.0.23 (CC0-1.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: npm@11.18.0 (Artistic-2.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: libapk@3.0.6-r0 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: glob@13.0.6 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: minimatch@10.2.5 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: zstd-libs@1.5.7-r2 (GPL-2.0-or-later)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: libgcc@15.2.0-r5 (LGPL-2.1-or-later, GPL-2.0-or-later)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: ca-certificates-bundle@20260611-r0 (MPL-2.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: alpine-baselayout-data@3.7.2-r1 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: busybox@1.37.0-r31 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: libcurl@8.21.0-r0 (curl)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: spdx-exceptions@2.5.0 (CC-BY-3.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: qrcode-terminal@0.12.0 (Apache 2.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: scanelf@1.3.9-r1 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: curl@8.21.0-r0 (curl)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: libstdc++`@15`.2.0-r5 (GPL-2.0-or-later, LGPL-2.1-or-later)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: common-ancestor-path@2.0.0 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: yallist@5.0.0 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: zlib@1.3.2-r0 (Zlib)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: alpine-baselayout@3.7.2-r1 (GPL-2.0-only)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: minipass-flush@1.0.6 (BlueOak-1.0.0)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: musl-utils@1.2.6-r2 (GPL-2.0-or-later)
ghcr.io/github/gh-aw-firewall/api-proxy:0.27.44:1:1: error: license policy violation: isexe@4.0.0 (BlueOak-1.0.0)

Remediation

Generated by 🛡️ Daily Container Image Security Scan · auto · 434.8 AIC · ⌖ 3.45 AIC · ⊞ 6.5K · ◷

Activity

  1. github-actions
    added
    security
    cookieIssue Monster Loves Cookies!
    on Aug 8, 2026
  2. pelikhan
    assigned
    Copilot
    and
    pelikhan
    on Aug 8, 2026

  3. github-actions commented on Aug 8, 2026

    @github-actions
    github-actionsbot
    on Aug 8, 2026 – with GitHub Actions
    ContributorAuthor

    🍪 Issue Monster selected this for Copilot\n\nI've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.\n\nIf assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.\n\nOm nom nom! 🍪

    🍪 Om nom nom by Issue Monster · gpt54 · 2.77 AIC · ⌖ 5.03 AIC · ⊞ 10.1K · ◷

  4. Copilot
    linked a pull request that will close this issue[WIP] Fix vulnerabilities in api-proxy container image #51333on Aug 8, 2026
  5. github-actions
    closed this as completedon Oct 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

cookieIssue Monster Loves Cookies!security

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions