Last scanned:
··This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who reaches the Next.js web service could potentially execute code inside the container, or block legitimate requests by exhausting CPU through CVE-2026-94482 or GHSA-2464-FHR4-W9XW. Note: GHSA-2464-FHR4-W9XW only applies to glibc-based runtimes, which this Alpine image may not meet, and the AVIF-related remote code execution risk applies only if AVIF optimization is enabled. The denial-of-service issue CVE-2026-94482 applies in the default configuration and is reachable by anyone who can send requests to the web server.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| GHSA-2464-fhr4-w9xw | HIGH7.6 | next 16.2.11 fixed in 15.5.28, 16.4.1 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-2xp9-vwfh-vxw4 | HIGH7.6 | next 16.2.11 fixed in 15.5.24, 16.3.3 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-673q-mjm6-r5xr | HIGH7.6 | next 16.2.11 fixed in 16.4.1 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-vcvr-r3jv-pc5j | HIGH7.6 | next 16.2.11 fixed in 16.3.6 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94482 | HIGH7.5 | next 16.2.11 fixed in 15.5.28, 16.4.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-114139 | HIGH7.28 | @sentry/nextjs 10.64.0 fixed in 9.47.2, 10.75.2, 11.0.0-rc.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-rgj7-g3m4-5g8c | HIGH7.12 | sharp 0.34.5 fixed in 0.35.4 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84375 | MEDIUM6 | js-yaml 3.15.0 fixed in 4.3.2, 3.15.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84375 | MEDIUM6 | js-yaml 4.3.0 fixed in 4.3.2, 3.15.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-2x7j-588g-ccc2 | MEDIUM6 | nodemailer 9.0.3 fixed in 9.1.0 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-v53p-9fqp-m79j | MEDIUM6 | nodemailer 9.0.3 fixed in 10.0.6 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2023-54404 | MEDIUM6 | zod 4.3.6 fixed in 4.6.6 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-f88m-g3jw-g9cj | MEDIUM5.6 | sharp 0.34.5 fixed in 0.35.0 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75604 | MEDIUM5.46 | next 16.2.11 fixed in 15.5.24, 16.3.3 | 2.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-13697 | MEDIUM5.46 | undici 7.28.0 fixed in 7.29.0, 8.9.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-84961 | MEDIUM5.46 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-94486 | MEDIUM5.4 | next 16.2.11 fixed in 16.3.8 | 0.1% Theoretical Threat | Directly ExposedContext importance: HIGH |
| GHSA-wq5f-xc86-pv6w | MEDIUM5.34 | sharp 0.34.5 fixed in 0.35.5 | — | Directly Exposed |
| CVE-2026-94485 | MEDIUM5.3 | next 16.2.11 fixed in 16.3.8 | 0.2% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-94543 | MEDIUM5.3 | next 16.2.11 fixed in 15.5.27, 16.3.8 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-94483 | MEDIUM5.2 | next 16.2.11 fixed in 16.3.8 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-110871 | MEDIUM5.2 | nodemailer 9.0.3 fixed in 10.0.10 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-85x2-q946-cp5h | MEDIUM5.2 | nodemailer 9.0.3 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM5.2 | nodemailer 9.0.3 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-cc9r-2j5m-2m83 | MEDIUM5.2 | nodemailer 9.0.3 fixed in 9.1.0 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-m943-m63m-w62w | MEDIUM5.2 | nodemailer 9.0.3 fixed in 10.1.4 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-wmmp-3585-3rmp | MEDIUM5.2 | nodemailer 9.0.3 fixed in 9.1.0 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111767 | MEDIUM5.16 | @modelcontextprotocol/sdk 1.29.0 fixed in 1.32.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-101909 | MEDIUM4.92 | axios 1.18.0 fixed in 0.34.0, 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-40345 | MEDIUM4.92 | deepmerge-ts 7.1.5 fixed in 8.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84933 | MEDIUM4.92 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94484 | MEDIUM4.8 | next 16.2.11 fixed in 16.3.8, 15.5.27 | 0.2% Theoretical Threat | Directly ExposedContext importance: HIGH |
| GHSA-6vj9-mwq6-2f5v | MEDIUM4.72 | nodemailer 9.0.3 fixed in 10.0.2 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-8m3c-c648-2xjj | MEDIUM4.72 | nodemailer 9.0.3 fixed in 9.1.1 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-8vvx-rff5-p5rq | MEDIUM4.72 | nodemailer 9.0.3 fixed in 10.0.2 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-104850 | MEDIUM4.5 | @modelcontextprotocol/sdk 1.29.0 fixed in 1.31.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-101901 | MEDIUM4.5 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101903 | MEDIUM4.5 | axios 1.18.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101906 | MEDIUM4.5 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-18446 | MEDIUM4.5 | fast-uri 3.1.4 fixed in 2.4.4, 3.1.5, 4.1.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75899 | MEDIUM4.5 | fast-uri 3.1.4 fixed in 2.4.5, 3.1.6, 4.1.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75931 | MEDIUM4.5 | fast-uri 3.1.4 fixed in 2.4.5, 3.1.6, 4.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75975 | MEDIUM4.5 | fast-uri 3.1.4 fixed in 2.4.5, 3.1.6, 4.1.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-76172 | MEDIUM4.5 | fast-uri 3.1.4 fixed in 2.4.5, 3.1.6, 4.1.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-84292 | MEDIUM4.5 | fast-uri 3.1.4 fixed in 2.4.6, 3.1.7, 4.1.4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-111756 | MEDIUM4.5 | follow-redirects 1.16.0 fixed in 1.16.1 | 0.5% Theoretical Threat | Directly Exposed |
| GHSA-5p4m-2wfm-xmqj | MEDIUM4.5 | js-yaml 3.15.0 fixed in 4.3.1, 3.15.1 | — | Directly Exposed |
| GHSA-5p4m-2wfm-xmqj | MEDIUM4.5 | js-yaml 4.3.0 fixed in 4.3.1, 3.15.1 | — | Directly Exposed |
| CVE-2026-67213 | MEDIUM4.5 | nanoid 3.3.12 fixed in 3.3.18, 5.1.6 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-67214 | MEDIUM4.5 | nanoid 3.3.12 fixed in 3.3.16, 5.1.16 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-109869 | MEDIUM4.5 | undici 7.28.0 fixed in 6.29.1, 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19534 | MEDIUM4.5 | undici 7.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-109841 | MEDIUM4.5 | undici 7.28.0 fixed in 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-109924 | MEDIUM4.5 | undici 7.28.0 fixed in 6.29.1, 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-14643 | MEDIUM4.5 | undici 7.28.0 fixed in 7.29.0, 8.9.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-85014 | MEDIUM4.5 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41907 | MEDIUM4.5 | uuid 10.0.0 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41907 | MEDIUM4.5 | uuid 3.3.3 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41907 | MEDIUM4.5 | uuid 8.3.2 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41907 | MEDIUM4.5 | uuid 9.0.1 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101916 | MEDIUM4.44 | @grpc/grpc-js 1.14.4 fixed in 1.13.6, 1.14.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-101905 | MEDIUM4.44 | axios 1.18.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101907 | LOW3.9 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101899 | LOW3.9 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101900 | LOW3.9 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101904 | LOW3.9 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101908 | LOW3.9 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-16728 | LOW3.9 | undici 7.28.0 fixed in 6.28.0, 7.29.0, 8.9.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-16729 | LOW3.9 | undici 7.28.0 fixed in 6.28.0, 7.29.0, 8.9.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-111768 | LOW3.83 | @modelcontextprotocol/sdk 1.29.0 fixed in 1.32.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-110306 | LOW3.66 | fast-uri 3.1.4 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly Exposed |
| GHSA-frvp-7c67-39w9 | LOW3.54 | @hono/node-server 1.19.14 fixed in 2.0.5, 1.19.15 | — | Directly Exposed |
| CVE-2026-101902 | LOW3.54 | axios 1.18.0 fixed in 0.34.0, 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111755 | LOW3.54 | follow-redirects 1.16.0 fixed in 1.16.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-18149 | LOW3.54 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84890 | LOW3.54 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-85024 | LOW3.54 | undici 7.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111771 | LOW3.47 | @modelcontextprotocol/sdk 1.29.0 fixed in 1.32.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-111769 | LOW3.31 | @modelcontextprotocol/sdk 1.29.0 fixed in 1.32.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-15157 | LOW3.24 | undici 7.28.0 fixed in 6.28.0, 7.29.0, 8.9.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-82417 | LOW3.18 | qs 6.15.2 fixed in 6.16.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84947 | LOW3.18 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-85008 | LOW3.18 | undici 7.28.0 fixed in 7.29.1, 8.10.2 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-101898 | LOW2.88 | axios 1.18.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-110180 | LOW2.88 | fast-uri 3.1.4 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86472 | LOW2.88 | fast-uri 3.1.4 fixed in 2.4.7, 3.1.8, 4.1.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-101915 | LOW2.22 | @grpc/grpc-js 1.14.4 fixed in 1.13.6, 1.14.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-110095 | LOW2.22 | fast-uri 3.1.4 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-110725 | LOW2.22 | fast-uri 3.1.4 fixed in 2.4.8, 3.1.9, 4.2.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-82562 | LOW2.22 | qs 6.15.2 fixed in 6.16.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-18540 | LOW2.22 | undici 7.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.3% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.