Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker can bypass JWT authentication (CVE-2015-9235), achieve remote code execution via lodash prototype pollution (CVE-2019-10744), or cause denial of service through crafted HTTP headers (CVE-2022-25881). No compensating controls can fully mitigate these risks without upgrading the affected packages.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2015-9235 | CRITICAL9.8 | jsonwebtoken 0.1.0 fixed in 4.2.2 | 8.7% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2015-9235 | CRITICAL9.8 | jsonwebtoken 0.4.0 fixed in 4.2.2 | 8.7% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2019-10744 | CRITICAL9.1 | lodash 2.4.2 fixed in 4.17.12 | 5.0% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2021-23337 | HIGH8.28 | lodash 2.4.2 fixed in 4.17.21 | 21.3% High Exploitation Risk | Directly ExposedContext importance: HIGH |
| CVE-2022-25881 | HIGH7.5 | http-cache-semantics 3.8.1 fixed in 4.1.1 | 1.6% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2017-18214 | HIGH7.5 | moment 2.0.0 fixed in 2.19.3 | 3.7% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2022-25887 | HIGH7.5 | sanitize-html 1.4.2 fixed in 2.7.1 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2023-32695 | HIGH7.5 | socket.io-parser 4.0.5 fixed in 4.2.3, 3.4.3, 3.3.4 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2020-8203 | HIGH7.4 | lodash.set 4.3.2 No fix yet | 5.2% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2020-15084 | HIGH7.28 | express-jwt 0.1.3 fixed in 6.0.0 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2022-41940 | MEDIUM6.5 | engine.io 4.1.2 fixed in 3.6.1, 6.2.1 | 1.9% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2018-3721 | MEDIUM6.5 | lodash 2.4.2 fixed in >=4.17.5 | 2.4% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2016-4055 | MEDIUM6.5 | moment 2.0.0 fixed in >=2.11.2 | 9.9% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2022-23540 | MEDIUM6.46 | jsonwebtoken 0.1.0 fixed in 9.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2022-23540 | MEDIUM6.46 | jsonwebtoken 0.4.0 fixed in 9.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | MEDIUM6.38 | brace-expansion 1.1.15 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | MEDIUM6.38 | brace-expansion 2.1.1 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-10732 | MEDIUM6.38 | decompress 4.2.1 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59725 | MEDIUM6.38 | engine.io 4.1.2 fixed in 6.6.7 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59869 | MEDIUM6.38 | js-yaml 3.14.2 fixed in 3.15.0, 4.3.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-65945 | MEDIUM6.38 | jws 0.2.6 fixed in 3.2.3, 4.0.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-26996 | MEDIUM6.38 | minimatch 3.0.5 fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-2359 | MEDIUM6.38 | multer 1.4.5-lts.2 fixed in 2.1.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-3304 | MEDIUM6.38 | multer 1.4.5-lts.2 fixed in 2.1.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-3520 | MEDIUM6.38 | multer 1.4.5-lts.2 fixed in 2.1.1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-5079 | MEDIUM6.38 | multer 1.4.5-lts.2 fixed in 2.2.0, 3.0.0-alpha.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-33151 | MEDIUM6.38 | socket.io-parser 4.0.5 fixed in 3.3.5, 3.4.4, 4.2.6 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41907 | MEDIUM6.38 | uuid 8.3.2 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-48779 | MEDIUM6.38 | ws 7.4.6 fixed in 5.2.5, 6.2.4, 7.5.11, 8.21.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2024-38355 | MEDIUM6.21 | socket.io 3.1.2 fixed in 2.5.1, 4.6.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2023-46233 | MEDIUM6.18 | crypto-js 3.3.0 fixed in 4.2.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2017-16016 | MEDIUM6.1 | sanitize-html 1.4.2 fixed in 1.11.4 | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2022-24785 | MEDIUM6 | moment 2.0.0 fixed in 2.29.2 | 5.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2024-37890 | MEDIUM5.9 | ws 7.4.6 fixed in 5.2.4, 6.2.3, 7.5.10, 8.17.1 | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2018-16487 | MEDIUM5.6 | lodash 2.4.2 fixed in >=4.17.11 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | libc6 2.41-12+deb13u3 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-27904 | MEDIUM5.52 | minimatch 3.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2021-23771 | MEDIUM5.52 | notevil 1.3.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-53486 | MEDIUM5.5 | decompress 4.2.1 No fix yet | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2022-23539 | MEDIUM5.5 | jsonwebtoken 0.1.0 fixed in 9.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2022-23539 | MEDIUM5.5 | jsonwebtoken 0.4.0 fixed in 9.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2022-23541 | MEDIUM5.35 | jsonwebtoken 0.1.0 fixed in 9.0.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2022-23541 | MEDIUM5.35 | jsonwebtoken 0.4.0 fixed in 9.0.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2019-1010024 | MEDIUM5.3 | libc6 2.41-12+deb13u3 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010025 | MEDIUM5.3 | libc6 2.41-12+deb13u3 No fix yet | 2.3% Low-Moderate Risk | Directly Exposed |
| CVE-2022-33987 | MEDIUM5.3 | got 8.3.2 fixed in 12.1.0, 11.8.5 | 2.2% Low-Moderate Risk | Directly Exposed |
| CVE-2021-26539 | MEDIUM5.3 | sanitize-html 1.4.2 fixed in 2.3.1 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2021-26540 | MEDIUM5.3 | sanitize-html 1.4.2 fixed in 2.3.2 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2024-21501 | MEDIUM5.3 | sanitize-html 1.4.2 fixed in 2.12.1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2016-1000237 | MEDIUM5.18 | sanitize-html 1.4.2 fixed in >=1.4.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2019-25225 | MEDIUM5.18 | sanitize-html 1.4.2 fixed in 2.0.0-beta | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | libc6 2.41-12+deb13u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-12590 | MEDIUM5.02 | body-parser 1.20.5 fixed in 1.20.6, 2.3.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-27903 | MEDIUM5.02 | minimatch 3.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | MEDIUM4.67 | zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-31808 | MEDIUM4.5 | file-type 16.5.4 fixed in 21.3.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53550 | MEDIUM4.5 | js-yaml 3.14.2 fixed in 4.2.0, 3.15.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-2950 | MEDIUM4.5 | lodash 2.4.2 fixed in 4.18.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-48997 | MEDIUM4.5 | multer 1.4.5-lts.2 fixed in 2.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-7338 | MEDIUM4.5 | multer 1.4.5-lts.2 fixed in 2.0.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | libc6 2.41-12+deb13u3 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | libc6 2.41-12+deb13u3 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2010-4756 | MEDIUM4 | libc6 2.41-12+deb13u3 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-26960 | LOW3.62 | tar 6.2.1 fixed in 7.5.8 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2019-1010022 | LOW3.53 | libc6 2.41-12+deb13u3 No fix yet | 3.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-3449 | LOW3.4 | @tootallnate/once 1.1.2 fixed in 3.0.1, 2.0.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-29786 | LOW3.21 | tar 6.2.1 fixed in 7.5.10 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2019-1010023 | LOW3.17 | libc6 2.41-12+deb13u3 No fix yet | 3.1% Low-Moderate Risk | Post-Exploit |
| CVE-2024-47764 | LOW3.15 | cookie 0.4.2 fixed in 0.7.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-23745 | LOW3.11 | tar 6.2.1 fixed in 7.5.3 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-31802 | LOW2.8 | tar 6.2.1 fixed in 7.5.11 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-53655 | LOW2.8 | tar 6.2.1 fixed in 7.5.16 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2018-20796 | LOW2.7 | libc6 2.41-12+deb13u3 No fix yet | 5.8% Low-Moderate Risk | Post-Exploit |
| CVE-2019-9192 | LOW2.7 | libc6 2.41-12+deb13u3 No fix yet | 2.4% Low-Moderate Risk | Post-Exploit |
| CVE-2026-59875 | LOW2.7 | tar 6.2.1 fixed in 7.5.17 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-24842 | LOW2.51 | tar 6.2.1 fixed in 7.5.7 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-59873 | LOW2.29 | tar 6.2.1 fixed in 7.5.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59874 | LOW2.29 | tar 6.2.1 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59871 | LOW2.29 | tar 6.2.1 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-23950 | LOW1.81 | tar 6.2.1 fixed in 7.5.4 | 0.2% Theoretical Threat | Post-Exploit |
| NSWG-ECO-428 | NONE0 | base64url 0.0.6 fixed in >=3.0.0 | — | Not Applicable |
| GHSA-rvg8-pwq2-xj7q | NONE0 | base64url 0.0.6 fixed in 3.0.0 | — | Not Applicable |
| CVE-2026-14257 | NONE0 | brace-expansion 1.1.15 fixed in 5.0.8 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-14257 | NONE0 | brace-expansion 2.1.1 fixed in 5.0.8 | 0.3% Theoretical Threat | Not Applicable |
| NSWG-ECO-17 | NONE0 | jsonwebtoken 0.1.0 fixed in >=4.2.2 | — | Not Applicable |
| NSWG-ECO-17 | NONE0 | jsonwebtoken 0.4.0 fixed in >=4.2.2 | — | Not Applicable |
| CVE-2016-1000223 | NONE0 | jws 0.2.6 fixed in >=3.0.0 | — | Not Applicable |
| GHSA-5mrr-rgp6-x4gr | NONE0 | marsdb 0.6.11 No fix yet | — | Not Applicable |
| CVE-2025-57349 | NONE0 | messageformat 2.3.0 fixed in 3.0.0-beta.0 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-47935 | NONE0 | multer 1.4.5-lts.2 fixed in 2.0.0 | 0.7% Theoretical Threat | Not Applicable |
| CVE-2025-47944 | NONE0 | multer 1.4.5-lts.2 fixed in 2.0.0 | 0.7% Theoretical Threat | Not Applicable |
| NSWG-ECO-154 | NONE0 | sanitize-html 1.4.2 fixed in >=1.11.4 | — | Not Applicable |
| GHSA-r292-9mhp-454m | NONE0 | tar 6.2.1 fixed in 7.5.21 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.