Vulnerability Reportnode:24.16.0-trixie

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most serious issues are in the base libraries: CVE-2009-3546 in libwmf can lead to remote code execution via a crafted GD file, and CVE-2019-1010023 in glibc can allow code execution if an attacker tricks a user into running ldd on a malicious binary. Upgrading the base image to a patched version or rebuilding with updated packages will fully resolve these findings. Note that CVE-2019-1010023 requires local user interaction (running ldd), so its practical exploitability in a typical Node container may be limited. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.