Vulnerability Reportnode:16.19-alpine

This base/runtime image ships critical vulnerabilities that any image built on it would inherit; they must be remediated before the final image goes to production. An attacker reaching the Node process could exploit CVE-2026-111497 to execute code or read process memory, and the scan found it is already being exploited in the wild. Because the image runs as root by default and its Alpine base is past end of support, the consequences are amplified for every derived service. Note: CVE-2025-15467 only applies if the application parses untrusted S/MIME or CMS data, and the CVE-2026-21710 crash only occurs if the app reads headersDistinct. The practical remediation is to rebuild on a supported base with a patched Node runtime and update the affected OpenSSL libraries in the final image. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.