Last scanned:
This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The main findings are denial-of-service flaws in the undici HTTP client library, such as CVE-2026-109869, which could crash or exhaust memory in a Node process that inherits this image. Each of these requires special configuration, meaning an application must actively make outbound fetch, WebSocket, or EventSource connections to an untrusted server, so the default container is not directly at risk. Images built on this base should be checked for those usage patterns and rebuilt against a patched undici version where they apply. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-109869 | MEDIUM6 | undici 6.28.0 fixed in 6.29.1, 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-19534 | MEDIUM6 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-109924 | MEDIUM6 | undici 6.28.0 fixed in 6.29.1, 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-85024 | MEDIUM4.72 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 5.0.9 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 5.0.9 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-93748 | MEDIUM4.5 | http-cache-semantics 4.2.0 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-104844 | LOW3.54 | postcss-selector-parser 7.1.4 fixed in 7.1.6, 6.1.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 5.0.9 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101910 | LOW3.18 | ip-address 10.5.0 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101911 | LOW3.18 | ip-address 10.5.0 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101912 | LOW3.18 | ip-address 10.5.0 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101913 | LOW3.18 | ip-address 10.5.0 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111997 | LOW3.18 | ip-address 10.5.0 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-18540 | LOW2.96 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
Want to check another image? Run a full scan with the Docker Security Scanner.