Dockerfile runtime is node:18-alpine, end-of-life since 2025-04-30
Hello, and thank you for this project.
The image built by Dockerfile runs on a base that no longer receives security fixes, and I thought it worth flagging.
What I observed
Dockerfile is single-stage:
1: FROM node:18-alpine
11: CMD ["npm", "run", "docker"]The base of the final stage is what becomes the image, so this is what ships — not a builder stage that gets discarded. I checked that specifically; several other candidates I looked at today turned out to use an old base only in a build stage whose final image was nginx or distroless, and I set those aside.
node:18-alpine is on a line that reached end-of-life on 2025-04-30.
Supported Node lines today are 22, 24 and 26.
What end-of-life means here
Node.js states the consequence in its own security-release notes:
"It's important to note that End-of-Life versions are always affected when a security release occurs."
The June 2026 release fixed twelve CVEs into 22.x, 24.x and 26.x, with older lines excluded:
| CVE | Severity | |
|---|---|---|
| CVE-2026-48933 | HIGH | WebCrypto AES integer overflow → remote process abort (DoS) |
| CVE-2026-48618 | HIGH | Unicode dot separator → TLS wildcard-depth authentication bypass |
| CVE-2026-48934 | Medium | TLS host identity verification bypass via session reuse |
| CVE-2026-48928 | Medium | Uppercase SNI matching → mTLS authorization bypass |
| CVE-2026-48615 | Medium | Proxy credentials leaked in ERR_PROXY_TUNNEL error message |
The July 2026 release, published this week, again patched only 26.x/24.x/22.x, with "the highest severity issue fixed in this release is HIGH."
Why nothing would have told you
The tag keeps resolving perfectly well — it simply stops being fixed, and nothing announces that. Dependabot's docker ecosystem is documented as supporting version updates but not security updates, so a base going end-of-life produces no alert at all.
What I did NOT check
- I did not pull or scan the published image; this is an analysis of the Dockerfile that builds it.
- I did not determine which of those CVEs are reachable in your usage, and I'm not claiming any is exploitable here. The narrower claim is that an end-of-life runtime ships and structurally cannot receive these fixes.
- The base distribution's own package set was not assessed separately.
Suggestion
Moving to a currently-supported line would put it back on a patched runtime. Happy to open the PR if that's useful.
Disclosure: AI-assisted (Claude Opus 5). I verified the Dockerfile stages, the EOL dates from endoflife.date, and the CVE lists from the upstream projects myself before posting.
Source: dzhng/deep-research