Vulnerability Reportoven/bun:1.2.22-alpine

oven/bun:1.2.22-alpine

digestsha256:ab596b6d0dcad05d23799b89451e92f4cdc16da184a9a4d240c42eaf3c4b9278

Executive Summary

Last scanned: Aug 1, 2026

Threat ScoreSAFE• High reputation community image (37M+ pulls) and pinned by digest provides strong supply-chain confidence.• No exposed surface vulnerabilities reach severity 6.0; the highest exposed severity is 5.9.• Post-exploit-only findings are limited to CVE-2025-15467, which has LOW context importance and requires the application to parse attacker-supplied CMS/PKCS#7 data, not part of Bun's normal operation.• Vulnerability counts are modest (24 exposed, 26 post-exploit), but none represent a practical risk in standard deployment.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (37M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. Although scanners report 24 exposed and 26 post-exploit findings, none exceed the medium-severity threshold, and the maximum exposed severity is 5.9. The only identified CVE (CVE-2025-15467) affects OpenSSL CMS/PKCS#7 parsing, which is not exercised during normal Bun runtime operation; it would only become relevant if the application explicitly processes untrusted CMS data. The image's strong provenance (pinned digest, 37M+ pulls) further reduces supply-chain risk.

Relevant for oven/bun:1.2.22-alpine

How to fix CVEs in runtime Docker images

Only a handful of these findings are real. Five steps that cut the count — and VEX for the rest.

Read the article

Vulnerabilities

Vulnerability Log

50 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-31790	MEDIUM5.9	libcrypto3 3.3.4-r0 fixed in 3.3.7-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2025-9231	MEDIUM5.9	libssl3 3.3.4-r0 fixed in 3.3.5-r0	2.2% Low-Moderate Risk	Directly Exposed
CVE-2026-31790	MEDIUM5.9	libssl3 3.3.4-r0 fixed in 3.3.7-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2025-9230	MEDIUM5.6	libcrypto3 3.3.4-r0 fixed in 3.3.5-r0	1.7% Low-Moderate Risk	Directly Exposed
CVE-2025-9230	MEDIUM5.6	libssl3 3.3.4-r0 fixed in 3.3.5-r0	1.7% Low-Moderate Risk	Directly Exposed
CVE-2025-15468	MEDIUM5.02	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2025-66199	MEDIUM5.02	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.4% Theoretical Threat	Directly Exposed
CVE-2025-69420	MEDIUM5.02	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-22796	MEDIUM5.02	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.5% Theoretical Threat	Directly Exposed
CVE-2025-15468	MEDIUM5.02	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2025-66199	MEDIUM5.02	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.4% Theoretical Threat	Directly Exposed
CVE-2025-69420	MEDIUM5.02	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-22796	MEDIUM5.02	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-22795	MEDIUM4.67	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-22795	MEDIUM4.67	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-6042	MEDIUM4.67	musl 1.2.5-r1 fixed in 1.2.5-r2	0.2% Theoretical Threat	Directly Exposed
CVE-2026-6042	MEDIUM4.67	musl-utils 1.2.5-r1 fixed in 1.2.5-r2	0.2% Theoretical Threat	Directly Exposed
CVE-2026-27171	MEDIUM4.67	zlib 1.3.1-r1 fixed in 1.3.2-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2025-15467	MEDIUM4.06	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	47.6% High Exploitation Risk	Post-Exploit
CVE-2025-15467	MEDIUM4.06	libssl3 3.3.4-r0 fixed in 3.3.6-r0	47.6% High Exploitation Risk	Post-Exploit
CVE-2025-68160	MEDIUM4	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2025-68160	MEDIUM4	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2025-69418	LOW3.4	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2025-69418	LOW3.4	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2025-9232	LOW3.1	libcrypto3 3.3.4-r0 fixed in 3.3.5-r0	2.3% Low-Moderate Risk	Directly Exposed
CVE-2025-9232	LOW3.1	libssl3 3.3.4-r0 fixed in 3.3.5-r0	2.3% Low-Moderate Risk	Directly Exposed
CVE-2026-31789	LOW3	libcrypto3 3.3.4-r0 fixed in 3.3.7-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-31789	LOW3	libssl3 3.3.4-r0 fixed in 3.3.7-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-28388	LOW2.7	libcrypto3 3.3.4-r0 fixed in 3.3.7-r0	1.1% Low-Moderate Risk	Post-Exploit
CVE-2026-28389	LOW2.7	libcrypto3 3.3.4-r0 fixed in 3.3.7-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-28390	LOW2.7	libcrypto3 3.3.4-r0 fixed in 3.3.7-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-28388	LOW2.7	libssl3 3.3.4-r0 fixed in 3.3.7-r0	1.1% Low-Moderate Risk	Post-Exploit
CVE-2026-28389	LOW2.7	libssl3 3.3.4-r0 fixed in 3.3.7-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-28390	LOW2.7	libssl3 3.3.4-r0 fixed in 3.3.7-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-28387	LOW2.48	libcrypto3 3.3.4-r0 fixed in 3.3.7-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-28387	LOW2.48	libssl3 3.3.4-r0 fixed in 3.3.7-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-40200	LOW2.39	musl 1.2.5-r1 fixed in 1.2.5-r3	0.2% Theoretical Threat	Post-Exploit
CVE-2026-40200	LOW2.39	musl-utils 1.2.5-r1 fixed in 1.2.5-r3	0.2% Theoretical Threat	Post-Exploit
CVE-2026-22184	LOW2.39	zlib 1.3.1-r1 fixed in 1.3.2-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2025-69421	LOW2.29	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2025-69421	LOW2.29	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2025-69419	LOW2.26	libcrypto3 3.3.4-r0 fixed in 3.3.6-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2025-69419	LOW2.26	libssl3 3.3.4-r0 fixed in 3.3.6-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2025-9231	LOW2.12	libcrypto3 3.3.4-r0 fixed in 3.3.5-r0	2.2% Low-Moderate Risk	Post-Exploit
CVE-2025-46394	LOW1.68	busybox 1.36.1-r29 fixed in 1.36.1-r31	0.2% Theoretical Threat	Post-Exploit
CVE-2025-46394	LOW1.68	busybox-binsh 1.36.1-r29 fixed in 1.36.1-r31	0.2% Theoretical Threat	Post-Exploit
CVE-2025-46394	LOW1.68	ssl_client 1.36.1-r29 fixed in 1.36.1-r31	0.2% Theoretical Threat	Post-Exploit
CVE-2024-58251	NONE0	busybox 1.36.1-r29 fixed in 1.36.1-r31	0.2% Theoretical Threat	Not Applicable
CVE-2024-58251	NONE0	busybox-binsh 1.36.1-r29 fixed in 1.36.1-r31	0.2% Theoretical Threat	Not Applicable
CVE-2024-58251	NONE0	ssl_client 1.36.1-r29 fixed in 1.36.1-r31	0.2% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.