Vulnerability Reportnode:22

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker who sends crafted compressed data or image uploads to an application built on these libraries could corrupt memory and potentially run code, or crash the service. CVE-2026-111497 only matters if an application or Node build actually decodes Brotli data through the Debian library rather than a bundled copy, and CVE-2026-32740 only applies if an application decodes HEIF or AVIF uploads with it. The container runs as root by default, so any compromise inside a derived image would carry elevated privileges, and the image is a building block rather than a deployable service. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.