Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could bypass JWT authentication via CVE-2015-9235 or cause prototype pollution via CVE-2019-10744, leading to unauthorized access or application logic manipulation. The image has 77 exposed findings, including 3 at severity 7.0 or higher with a max of 7.84, while post-exploit findings are 23 total, none at severity 6.0 or higher, max 3.62. Note: CVE-2015-9235 only applies if the application verifies asymmetric JWT signatures and accepts symmetric tokens; CVE-2019-10744 requires lodash.defaultsDeep to process untrusted input. Trust signals such as popular community status and digest pinning do not offset these exploitable flaws.
Hardening plan for this image · 4 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2015-9235 | HIGH7.84 | jsonwebtoken 0.1.0 fixed in 4.2.2 | 8.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2015-9235 | HIGH7.84 | jsonwebtoken 0.4.0 fixed in 4.2.2 | 8.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-10744 | HIGH7.28 | lodash 2.4.2 fixed in 4.17.12 | 5.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-95619 | MEDIUM6.54 | libgomp1 14.2.0-19 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95619 | MEDIUM6.54 | libstdc++6 14.2.0-19 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2018-3721 | MEDIUM6.5 | lodash 2.4.2 fixed in >=4.17.5 | 2.3% Low-Moderate Risk | Directly Exposed |
| CVE-2016-4055 | MEDIUM6.5 | moment 2.0.0 fixed in >=2.11.2 | 9.9% Low-Moderate Risk | Directly Exposed |
| CVE-2021-23771 | MEDIUM6.5 | notevil 1.3.3 No fix yet | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2022-23540 | MEDIUM6.46 | jsonwebtoken 0.1.0 fixed in 9.0.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2022-23540 | MEDIUM6.46 | jsonwebtoken 0.4.0 fixed in 9.0.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-102990 | MEDIUM6.38 | basic-ftp 5.3.1 fixed in 6.2.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45822 | MEDIUM6.38 | decode-uri-component 0.2.2 fixed in 0.5.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-10732 | MEDIUM6.38 | decompress 4.2.1 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-93748 | MEDIUM6.38 | http-cache-semantics 3.8.1 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-65945 | MEDIUM6.38 | jws 0.2.6 fixed in 3.2.3, 4.0.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-26996 | MEDIUM6.38 | minimatch 3.0.5 fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-41907 | MEDIUM6.38 | uuid 8.3.2 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2017-16016 | MEDIUM6.1 | sanitize-html 1.4.2 fixed in 1.11.4 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-101894 | MEDIUM6.03 | decompress 4.2.1 No fix yet | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2017-18214 | MEDIUM6 | moment 2.0.0 fixed in 2.19.3 | 3.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2022-25887 | MEDIUM6 | sanitize-html 1.4.2 fixed in 2.7.1 | 1.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-102010 | MEDIUM5.95 | gcc-14-base 14.2.0-19 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM5.95 | libc6 2.41-12+deb13u4 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM5.95 | libc6 2.41-12+deb13u4 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-102010 | MEDIUM5.95 | libgcc-s1 14.2.0-19 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102010 | MEDIUM5.95 | libgomp1 14.2.0-19 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102010 | MEDIUM5.95 | libstdc++6 14.2.0-19 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19499 | MEDIUM5.78 | libc6 2.41-12+deb13u4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2018-16487 | MEDIUM5.6 | lodash 2.4.2 fixed in >=4.17.11 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | libc6 2.41-12+deb13u4 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-27904 | MEDIUM5.52 | minimatch 3.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-53486 | MEDIUM5.5 | decompress 4.2.1 No fix yet | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2020-15084 | MEDIUM5.46 | express-jwt 0.1.3 fixed in 6.0.0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-113661 | MEDIUM5.4 | sanitize-html 1.4.2 fixed in 2.18.0 | — | Directly Exposed |
| CVE-2022-23541 | MEDIUM5.35 | jsonwebtoken 0.1.0 fixed in 9.0.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2022-23541 | MEDIUM5.35 | jsonwebtoken 0.4.0 fixed in 9.0.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2019-1010024 | MEDIUM5.3 | libc6 2.41-12+deb13u4 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010025 | MEDIUM5.3 | libc6 2.41-12+deb13u4 No fix yet | 2.5% Low-Moderate Risk | Directly Exposed |
| CVE-2022-33987 | MEDIUM5.3 | got 8.3.2 fixed in 12.1.0, 11.8.5 | 2.4% Low-Moderate Risk | Directly Exposed |
| CVE-2021-26539 | MEDIUM5.3 | sanitize-html 1.4.2 fixed in 2.3.1 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2021-26540 | MEDIUM5.3 | sanitize-html 1.4.2 fixed in 2.3.2 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2024-21501 | MEDIUM5.3 | sanitize-html 1.4.2 fixed in 2.12.1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-39243 | MEDIUM5.18 | decompress 4.2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2016-1000237 | MEDIUM5.18 | sanitize-html 1.4.2 fixed in >=1.4.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2019-25225 | MEDIUM5.18 | sanitize-html 1.4.2 fixed in 2.0.0-beta | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-24785 | MEDIUM5.17 | moment 2.0.0 fixed in 2.29.2 | 13.9% High Exploitation Risk | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | libc6 2.41-12+deb13u4 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-6791 | MEDIUM5.02 | libc6 2.41-12+deb13u4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77117 | MEDIUM5.02 | libc6 2.41-12+deb13u4 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-80489 | MEDIUM5.02 | libc6 2.41-12+deb13u4 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-27903 | MEDIUM5.02 | minimatch 3.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2021-23337 | MEDIUM4.97 | lodash 2.4.2 fixed in 4.17.21 | 21.3% High Exploitation Risk | Directly Exposed |
| CVE-2026-113654 | MEDIUM4.7 | sanitize-html 1.4.2 fixed in 2.18.0 | — | Directly Exposed |
| CVE-2026-6368 | MEDIUM4.67 | libc6 2.41-12+deb13u4 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | MEDIUM4.67 | zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | MEDIUM4.5 | libc6 2.41-12+deb13u4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-31808 | MEDIUM4.5 | file-type 16.5.4 fixed in 21.3.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-2950 | MEDIUM4.5 | lodash 2.4.2 fixed in 4.18.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc6 2.41-12+deb13u4 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2022-23539 | MEDIUM4.13 | jsonwebtoken 0.1.0 fixed in 9.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2022-23539 | MEDIUM4.13 | jsonwebtoken 0.4.0 fixed in 9.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-106444 | MEDIUM4 | handlebars 4.7.9 fixed in 4.7.10 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2010-4756 | MEDIUM4 | libc6 2.41-12+deb13u4 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-26960 | LOW3.62 | tar 6.2.1 fixed in 7.5.8 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-19542 | LOW3.57 | libc6 2.41-12+deb13u4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc6 2.41-12+deb13u4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2019-1010022 | LOW3.53 | libc6 2.41-12+deb13u4 No fix yet | 3.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-3449 | LOW3.4 | @tootallnate/once 1.1.2 fixed in 3.0.1, 2.0.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-29786 | LOW3.21 | tar 6.2.1 fixed in 7.5.10 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2019-1010023 | LOW3.17 | libc6 2.41-12+deb13u4 No fix yet | 3.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-97399 | LOW3.15 | libc6 2.41-12+deb13u4 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-23745 | LOW3.11 | tar 6.2.1 fixed in 7.5.3 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-31802 | LOW2.8 | tar 6.2.1 fixed in 7.5.11 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-53655 | LOW2.8 | tar 6.2.1 fixed in 7.5.16 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2023-46233 | LOW2.78 | crypto-js 3.3.0 fixed in 4.2.0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-71851 | LOW2.75 | crypto-js 3.3.0 fixed in 4.0.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2018-20796 | LOW2.7 | libc6 2.41-12+deb13u4 No fix yet | 5.8% Low-Moderate Risk | Post-Exploit |
| CVE-2019-9192 | LOW2.7 | libc6 2.41-12+deb13u4 No fix yet | 2.4% Low-Moderate Risk | Post-Exploit |
| CVE-2022-25881 | LOW2.7 | http-cache-semantics 3.8.1 fixed in 4.1.1 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-59875 | LOW2.7 | tar 6.2.1 fixed in 7.5.17 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-24842 | LOW2.51 | tar 6.2.1 fixed in 7.5.7 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-106445 | LOW2.48 | handlebars 4.7.9 fixed in 4.7.10 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-106446 | LOW2.48 | handlebars 4.7.9 fixed in 4.7.10 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-95619 | LOW2.36 | gcc-14-base 14.2.0-19 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-95619 | LOW2.36 | libgcc-s1 14.2.0-19 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59873 | LOW2.29 | tar 6.2.1 fixed in 7.5.19 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59874 | LOW2.29 | tar 6.2.1 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.29 | tar 6.2.1 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-59871 | LOW2.29 | tar 6.2.1 fixed in 7.5.18 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-23950 | LOW1.81 | tar 6.2.1 fixed in 7.5.4 | 0.3% Theoretical Threat | Post-Exploit |
| DSA-6572-1 | NONE0 | ca-certificates 20250419 fixed in 20250419+deb13u1 | — | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| NSWG-ECO-428 | NONE0 | base64url 0.0.6 fixed in >=3.0.0 | — | Not Applicable |
| GHSA-rvg8-pwq2-xj7q | NONE0 | base64url 0.0.6 fixed in 3.0.0 | — | Not Applicable |
| NSWG-ECO-17 | NONE0 | jsonwebtoken 0.1.0 fixed in >=4.2.2 | — | Not Applicable |
| NSWG-ECO-17 | NONE0 | jsonwebtoken 0.4.0 fixed in >=4.2.2 | — | Not Applicable |
| CVE-2016-1000223 | NONE0 | jws 0.2.6 fixed in >=3.0.0 | — | Not Applicable |
| GHSA-5mrr-rgp6-x4gr | NONE0 | marsdb 0.6.11 No fix yet | — | Not Applicable |
| CVE-2025-57349 | NONE0 | messageformat 2.3.0 fixed in 3.0.0-beta.0 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-63670 | NONE0 | sanitize-html 1.4.2 fixed in 2.17.6 | 0.3% Theoretical Threat | Not Applicable |
| NSWG-ECO-154 | NONE0 | sanitize-html 1.4.2 fixed in >=1.11.4 | — | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.