Vulnerability Reportnginxinc/nginx-unprivileged:1.31.7-alpine-slim

nginxinc/nginx-unprivileged:alpine3.24-slimnginxinc/nginx-unprivileged:alpine-slimnginxinc/nginx-unprivileged:mainline-alpine3.24-slimnginxinc/nginx-unprivileged:mainline-alpine-slimnginxinc/nginx-unprivileged:1-alpine3.24-slimnginxinc/nginx-unprivileged:1-alpine-slimnginxinc/nginx-unprivileged:1.31-alpine3.24-slimnginxinc/nginx-unprivileged:1.31-alpine-slimnginxinc/nginx-unprivileged:1.31.7-alpine3.24-slimnginxinc/nginx-unprivileged:1.31.7-alpine-slim

digestsha256:a8cb0f33d51fa107c96fd2bd3a71aaf564ec131e9d2bdf8700944f0ed8b170d7

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreSAFE• Published by a verified vendor (nginxinc) and pinned by immutable digest, with a trust score of 100.• Three exposed-surface findings exist, but the highest severity is 5.0 and none reach 6.0 or higher.• None of the exposed findings are listed as known exploited in the wild.• No post-exploit-only findings were reported.• The container runs as non-root user 101 on unprivileged port 8080, and no optional nginx modules are enabled by the shipped configuration.

1/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. Three lower-severity exposed-surface findings were identified, with a maximum severity of 5.0, and none are known to be actively exploited. None of these findings are rated high enough to change the verdict in this context. The image is published by a verified vendor, pinned by digest, and runs as an unprivileged user on a non-privileged port. Continue routine scanning and patching to keep the attack surface small over time.

Vulnerabilities

Vulnerability Log

3 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.