Three service images run Node 18.12/18.13 — end-of-life line, pinned to a 2022 patch

Hello, and thank you for this project.

The image built by three service Dockerfiles runs on a base that no longer receives security fixes, and I thought it worth flagging.

What I observed

Three Dockerfiles whose final stage is Node 18, each with its own CMD:

The plugin-api one is explicit about it:

 1:  FROM node:18.13.0-slim AS production
36:  EXPOSE ${PORT}
39:  CMD [ "node", "./main.js" ]

The base of the final stage is what becomes the image, so this is what ships — not a builder stage that gets discarded. I checked that specifically; several other candidates I looked at today turned out to use an old base only in a build stage whose final image was nginx or distroless, and I set those aside.

node:18.12.1 / node:18.13.0 is on a line that reached end-of-life on 2025-04-30. There are really two issues here. The line is end-of-life. But the pin is also exact and old: 18.12.1 is November 2022 and 18.13.0 is January 2023, while the final Node 18 release was 18.20.8. An exact tag cannot pick up patch-level security fixes by design, so these images sat roughly two dozen patch releases behind their own line for over two years before that line went EOL. Pinning a floating minor (node:22) rather than an exact patch would prevent that half independently.

What end-of-life means here

Node.js states the consequence in its own security-release notes:

"It's important to note that End-of-Life versions are always affected when a security release occurs."

The June 2026 release fixed twelve CVEs into 22.x, 24.x and 26.x, with older lines excluded:

The July 2026 release, published this week, again patched only 26.x/24.x/22.x, with "the highest severity issue fixed in this release is HIGH."

Why nothing would have told you

The tag keeps resolving perfectly well — it simply stops being fixed, and nothing announces that. Dependabot's docker ecosystem is documented as supporting version updates but not security updates, so a base going end-of-life produces no alert at all.

What I did NOT check

• I did not pull or scan the published image; this is an analysis of the Dockerfile that builds it.
• I did not determine which of those CVEs are reachable in your usage, and I'm not claiming any is exploitable here. The narrower claim is that an end-of-life runtime ships and structurally cannot receive these fixes.
• The base distribution's own package set was not assessed separately.

Suggestion

Moving to a currently-supported line would put it back on a patched runtime. Happy to open the PR if that's useful.

Disclosure: AI-assisted (Claude Opus 5). I verified the Dockerfile stages, the EOL dates from endoflife.date, and the CVE lists from the upstream projects myself before posting.