Vulnerability Reportnode:24.22.2-alpine3.24

node:24.22.2-alpine3.24node:24.22.2-alpine

digestsha256:a34ab6d7f6f4813f4d0c5469d74685604b962fbdbf5793a7bc7b4998ecb867c8

Executive Summary

Last scanned: Nov 9, 2026

Threat ScoreSAFE• The scan found 15 low-severity findings that matter only after the container is already compromised, with the highest rated 2.7.• No findings are reachable from the network in normal operation, so the image exposes no network-facing weakness in its default setup.• The image is the official Docker-published Node image, carries the TRUSTED reputation verdict, and is pinned by digest, so its contents are immutable.• The image exposes no ports by default, which limits direct external attack paths.• Because the image runs as root by default, any post-compromise weakness would have greater impact, so images built on it should drop root privileges.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. It does contain 15 post-exploit findings, but the highest severity is 2.7 and each would only matter after an attacker had already gained a foothold inside a container built from it. Images built on top of it should still run as a non-root user and be rebuilt regularly to pick up upstream fixes. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

15 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-102276	LOW2.7	brace-expansion 5.0.9 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19	0.5% Theoretical Threat	Post-Exploit
CVE-2026-102278	LOW2.7	brace-expansion 5.0.9 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20	0.5% Theoretical Threat	Post-Exploit
CVE-2026-93748	LOW2.7	http-cache-semantics 4.2.0 No fix yet	0.6% Theoretical Threat	Post-Exploit
CVE-2026-109869	LOW2.7	undici 6.28.0 fixed in 6.29.1, 7.30.1, 8.12.2	0.3% Theoretical Threat	Post-Exploit
CVE-2026-19534	LOW2.7	undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-109924	LOW2.7	undici 6.28.0 fixed in 6.29.1, 7.30.1, 8.12.2	0.3% Theoretical Threat	Post-Exploit
CVE-2026-104844	LOW2.12	postcss-selector-parser 7.1.4 fixed in 7.1.6, 6.1.5	0.4% Theoretical Threat	Post-Exploit
CVE-2026-85024	LOW2.12	undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-102277	LOW1.91	brace-expansion 5.0.9 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21	0.4% Theoretical Threat	Post-Exploit
CVE-2026-101910	LOW1.91	ip-address 10.5.0 fixed in 10.5.1	0.4% Theoretical Threat	Post-Exploit
CVE-2026-101911	LOW1.91	ip-address 10.5.0 fixed in 10.7.1	0.4% Theoretical Threat	Post-Exploit
CVE-2026-101912	LOW1.91	ip-address 10.5.0 fixed in 10.7.1	0.4% Theoretical Threat	Post-Exploit
CVE-2026-101913	LOW1.91	ip-address 10.5.0 fixed in 10.5.1	0.4% Theoretical Threat	Post-Exploit
CVE-2026-111997	LOW1.91	ip-address 10.5.0 fixed in 10.7.4	0.3% Theoretical Threat	Post-Exploit
CVE-2026-18540	LOW1.33	undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2	0.3% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.