Repository navigation
[container-image-scan] Node CVE burn-down #65791
Description
Overview
Node family, scan of 2026-10-12. Owners: Docker official node image and ghcr.io/github/gh-aw-node (neither built from this repository; Upstream — tracked only).
| Image (pinned) | Status | Crit | High | Med | Low | Negl | Unk | Rejected licenses |
|---|---|---|---|---|---|---|---|---|
node:lts-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 |
upstream | 0 | 17 | 25 | 9 | 0 | 0 | 0 |
ghcr.io/github/gh-aw-node@sha256:11c2c544876cdbaffefe0f7f1283b74838c209654b4934a78e23ed11f750490f |
upstream | 0 | 12 | 15 | 8 | 0 | 0 | 0 |
Counts are raw scanner rows. Order: Critical, High, Medium, Low, Unknown. Format: [severity] ID: package@installed (fix: fixed versions). License status: clean.
Details
Findings: node:lts-alpine
[High] CVE-2026-54873: libcrypto3@3.5.8-r0
[High] CVE-2026-54873: libssl3@3.5.8-r0
[High] CVE-2026-72897: libcrypto3@3.5.8-r0
[High] CVE-2026-72897: libssl3@3.5.8-r0
[High] CVE-2026-84782: libcrypto3@3.5.8-r0
[High] CVE-2026-84782: libssl3@3.5.8-r0
[High] CVE-2026-84784: libcrypto3@3.5.8-r0
[High] CVE-2026-84784: libssl3@3.5.8-r0
[High] CVE-2026-85091: zlib@1.3.2-r0 (fix: 1.3.2-r1)
[High] GHSA-6j4f-fj2g-mc7p: brace-expansion@5.0.7 (fix: 5.0.10)
[High] GHSA-ch52-4w7c-c8xp: http-cache-semantics@4.2.0
[High] GHSA-mh99-v99m-4gvg: brace-expansion@5.0.7 (fix: 5.0.8)
[High] GHSA-mwp4-54f8-5fhr: ip-address@10.2.0 (fix: 10.3.1)
[High] GHSA-qhr7-859c-m2p7: brace-expansion@5.0.7 (fix: 5.0.11)
[High] GHSA-r292-9mhp-454m: tar@7.5.19 (fix: 7.5.21)
[High] GHSA-rfgv-xxqx-mfg5: undici@6.27.0 (fix: 6.28.1)
[High] GHSA-rgw5-rvv9-x895: brace-expansion@5.0.7 (fix: 5.0.9)
[Medium] CVE-2025-60876: busybox-binsh@1.37.0-r31
[Medium] CVE-2025-60876: busybox@1.37.0-r31
[Medium] CVE-2025-60876: ssl_client@1.37.0-r31
[Medium] CVE-2026-35189: libcrypto3@3.5.8-r0
[Medium] CVE-2026-35189: libssl3@3.5.8-r0
[Medium] CVE-2026-42772: libcrypto3@3.5.8-r0
[Medium] CVE-2026-42772: libssl3@3.5.8-r0
[Medium] CVE-2026-75804: libcrypto3@3.5.8-r0
[Medium] CVE-2026-75804: libssl3@3.5.8-r0
[Medium] CVE-2026-75805: libcrypto3@3.5.8-r0
[Medium] CVE-2026-75805: libssl3@3.5.8-r0
[Medium] CVE-2026-75806: libcrypto3@3.5.8-r0
[Medium] CVE-2026-75806: libssl3@3.5.8-r0
[Medium] GHSA-22jq-vg5j-6vgg: ip-address@10.2.0 (fix: 10.2.1)
[Medium] GHSA-2vr4-cq9g-pvrc: ip-address@10.2.0 (fix: 10.5.1)
[Medium] GHSA-3wwx-pv8p-q78v: undici@6.27.0 (fix: 6.28.1)
[Medium] GHSA-4xrf-jv44-h6hh: ip-address@10.2.0 (fix: 10.2.2)
[Medium] GHSA-8xcm-r25x-g524: undici@6.27.0 (fix: 6.28.0)
[Medium] GHSA-h3mg-xc3c-68pw: ip-address@10.2.0 (fix: 10.7.1)
[Medium] GHSA-j6r3-76f7-8jcv: ip-address@10.2.0 (fix: 10.7.1)
[Medium] GHSA-m8rv-5g2x-5cg5: undici@6.27.0 (fix: 6.28.0)
[Medium] GHSA-q2hr-2g5m-vwhr: brace-expansion@5.0.7 (fix: 5.0.12)
[Medium] GHSA-rj75-hqrm-r3gf: postcss-selector-parser@7.1.4 (fix: 7.1.6)
[Medium] GHSA-rpw4-54j3-4h4q: ip-address@10.2.0 (fix: 10.5.1)
[Medium] GHSA-v3r7-h72x-cjcm: undici@6.27.0 (fix: 6.28.0)
[Low] CVE-2026-35191: libcrypto3@3.5.8-r0
[Low] CVE-2026-35191: libssl3@3.5.8-r0
[Low] CVE-2026-54872: libcrypto3@3.5.8-r0
[Low] CVE-2026-54872: libssl3@3.5.8-r0
[Low] CVE-2026-54875: libcrypto3@3.5.8-r0
[Low] CVE-2026-54875: libssl3@3.5.8-r0
[Low] CVE-2026-77696: libcrypto3@3.5.8-r0
[Low] CVE-2026-77696: libssl3@3.5.8-r0
[Low] GHSA-r53p-7pc4-xj5r: undici@6.27.0 (fix: 6.28.1)
Findings: ghcr.io/github/gh-aw-node
[High] CVE-2026-103111: pcre2@10.48-r0 (fix: 10.49-r0)
[High] CVE-2026-54873: libcrypto3@3.5.8-r0
[High] CVE-2026-54873: libssl3@3.5.8-r0
[High] CVE-2026-72897: libcrypto3@3.5.8-r0
[High] CVE-2026-72897: libssl3@3.5.8-r0
[High] CVE-2026-84782: libcrypto3@3.5.8-r0
[High] CVE-2026-84782: libssl3@3.5.8-r0
[High] CVE-2026-84784: libcrypto3@3.5.8-r0
[High] CVE-2026-84784: libssl3@3.5.8-r0
[High] CVE-2026-85091: zlib@1.3.2-r0 (fix: 1.3.2-r1)
[High] CVE-2026-93990: libexpat@2.8.4-r0 (fix: 2.8.5-r0)
[High] GHSA-ch52-4w7c-c8xp: http-cache-semantics@4.2.0
[Medium] CVE-2025-60876: busybox-binsh@1.37.0-r31
[Medium] CVE-2025-60876: busybox@1.37.0-r31
[Medium] CVE-2025-60876: ssl_client@1.37.0-r31
[Medium] CVE-2026-35189: libcrypto3@3.5.8-r0
[Medium] CVE-2026-35189: libssl3@3.5.8-r0
[Medium] CVE-2026-42772: libcrypto3@3.5.8-r0
[Medium] CVE-2026-42772: libssl3@3.5.8-r0
[Medium] CVE-2026-58055: nghttp2-libs@1.69.0-r0 (fix: 1.70.0-r0)
[Medium] CVE-2026-75804: libcrypto3@3.5.8-r0
[Medium] CVE-2026-75804: libssl3@3.5.8-r0
[Medium] CVE-2026-75805: libcrypto3@3.5.8-r0
[Medium] CVE-2026-75805: libssl3@3.5.8-r0
[Medium] CVE-2026-75806: libcrypto3@3.5.8-r0
[Medium] CVE-2026-75806: libssl3@3.5.8-r0
[Medium] GHSA-rj75-hqrm-r3gf: postcss-selector-parser@7.1.4 (fix: 7.1.6)
[Low] CVE-2026-35191: libcrypto3@3.5.8-r0
[Low] CVE-2026-35191: libssl3@3.5.8-r0
[Low] CVE-2026-54872: libcrypto3@3.5.8-r0
[Low] CVE-2026-54872: libssl3@3.5.8-r0
[Low] CVE-2026-54875: libcrypto3@3.5.8-r0
[Low] CVE-2026-54875: libssl3@3.5.8-r0
[Low] CVE-2026-77696: libcrypto3@3.5.8-r0
[Low] CVE-2026-77696: libssl3@3.5.8-r0
Remediation and SLA
- Cadence: Critical findings are remediated or explicitly risk-accepted within 7 days; High within 30 days; every scanned image is rebuilt on a refreshed base image at least weekly.
- Default step: the daily
gh aw compile --force-refresh-container-pinsrun opens a pin-refresh PR once the owner publishes a fixed image. No local code-fix PR is requested: the build config for these images is not ingithub/gh-aw. - Fixed package versions in the details identify what the upstream rebuild must contain. No fixed image tag/digest is known yet and none is invented here.
- Exception (rows with no fix listed): responsible project = owner named above; advisory = scanner URL for the CVE/GHSA/GO id; next review = 2026-10-19; status = tracked, not risk-accepted (no maintainer approval recorded).
- Every finding is Upstream — tracked only. License rows need a maintainer policy decision (allow-list or upstream change).
Index: #52657
Generated by 🛡️ Daily Container Image Security Scan · copilot · auto · 156.9 AIC · ⌖ 0.792 AIC · ⊞ 8.5K · ◷
Activity