Last scanned:
This base/runtime image ships critical vulnerabilities that any image built on it would inherit; they must be remediated before the final image goes to production. An attacker exploiting CVE-2026-111497 through crafted compressed input could corrupt memory, crash the application, or execute arbitrary code inside the container. Because this flaw is in the Node runtime itself and requires no non-default option, every image built on this base inherits the exposure. Rebuild the final image on a patched Node runtime that fixes CVE-2026-111497 before deployment. The ip-address finding, CVE-2026-69192, only matters if an application uses that library for SSRF filtering and should be reviewed in the application code. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
Hardening plan for this image · 5 steps. The first closes an actively exploited CVE.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | CRITICAL10 | node 20.20.2 No fix yet | 55.5% Actively Exploited | Directly ExposedContext importance: HIGH |
| CVE-2026-69192 | MEDIUM6.88 | ip-address 9.0.5 fixed in 10.3.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42764 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42764 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42338 | MEDIUM4.88 | ip-address 9.0.5 fixed in 10.1.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45447 | MEDIUM4.86 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14257 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-69152 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33750 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-24001 | MEDIUM4.5 | diff 5.2.0 fixed in 8.0.3, 5.2.2, 4.0.4, 3.5.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-64756 | MEDIUM4.5 | glob 10.4.2 fixed in 11.1.0, 10.5.0 | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-93748 | MEDIUM4.5 | http-cache-semantics 4.1.1 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-26996 | MEDIUM4.5 | minimatch 9.0.5 fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27903 | MEDIUM4.5 | minimatch 9.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27904 | MEDIUM4.5 | minimatch 9.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-9496 | MEDIUM4.5 | pacote 18.0.6 fixed in 21.5.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-48815 | MEDIUM4.5 | sigstore 2.3.1 fixed in 4.1.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-101911 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-101912 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-101913 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111997 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2024-21538 | LOW3.83 | cross-spawn 7.0.3 fixed in 7.0.5, 6.0.6 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-29786 | LOW3.78 | tar 6.2.1 fixed in 7.5.10 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-23745 | LOW3.66 | tar 6.2.1 fixed in 7.5.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-104844 | LOW3.54 | postcss-selector-parser 6.1.0 fixed in 7.1.6, 6.1.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-31802 | LOW3.3 | tar 6.2.1 fixed in 7.5.11 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53655 | LOW3.3 | tar 6.2.1 fixed in 7.5.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-48758 | LOW3.24 | @sigstore/core 1.1.0 fixed in 3.2.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | LOW3.18 | brace-expansion 2.0.1 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 2.0.1 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-24842 | LOW2.95 | tar 6.2.1 fixed in 7.5.7 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59873 | LOW2.7 | tar 6.2.1 fixed in 7.5.19 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59874 | LOW2.7 | tar 6.2.1 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.7 | tar 6.2.1 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-59871 | LOW2.7 | tar 6.2.1 fixed in 7.5.18 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-9358 | LOW2.58 | postcss-selector-parser 6.1.0 fixed in 6.1.3, 7.1.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-26960 | LOW2.56 | tar 6.2.1 fixed in 7.5.8 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-23950 | LOW2.12 | tar 6.2.1 fixed in 7.5.4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-59875 | LOW1.91 | tar 6.2.1 fixed in 7.5.17 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-5889 | LOW1.58 | brace-expansion 2.0.1 fixed in 2.0.2, 1.1.12, 3.0.1, 4.0.1 | 0.6% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.