bug: move Dockerfile base image to node:22.23.2-bookworm (fixes imagemagick CVE-2026-25987) - #260
Open
devin-ai-integration[bot] wants to merge 1 commit into
Conversation
…ode:22.23.2-bookworm to fix imagemagick CVE-2026-25987
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Snyk Container
SNYK-DEBIAN11-IMAGEMAGICK-15339622/ CVE-2026-25987 (heap over-read in the ImageMagick MAP decoder, CVSS 9.1):FROM node:18.13.0is a Debian 11 image shippingimagemagick 8:6.9.11.60+dfsg-1.3. The app shells out toidentifyon user-supplied input (routes/index.js), so the vulnerable decoder is reachable.Why not the tags used by sibling PRs / Snyk's suggestion:
node:18.20.8-bookworm(used by bug: fix SNYK-DEBIAN11-CURL-3320493 (CVE-2023-23914) by moving base image to Debian 12 #118/bug: fix SNYK-DEBIAN11-AOM-1298721 (CVE-2021-30474) by moving the Docker base image to node:18.20.8-bookworm #120/bug: fix SNYK-DEBIAN11-AOM-1290331 (CVE-2021-30473) by moving the Docker base image to node:18.20.8-bookworm #147-bug: fix SNYK-DEBIAN11-AOM-7197980 (CVE-2024-5171) by moving base image to node:18.20.8-bookworm #150) is frozen: Node 18 is EOL and docker-library stopped rebuilding it in 2025 (last repo-info scan 2025-05-31, image created 2025-03-27,imagemagick 8:6.9.11.60+dfsg-1.6+deb12u3). Debian 12's fix for this CVE is DSA-6159-1 (+deb12u7, 2026), so that tag remains vulnerable.node:22.23.2-bookwormis the current LTS image (built 2026-08-25) and shipsimagemagick 8:6.9.11.60+dfsg-1.6+deb12u13>= deb12u7 (also newer curl/expat/aom than the sibling PRs' target).node:18.20.5-alpine3.19(Snyk's suggestion) dropsbuildpack-deps, i.e. noidentifybinary, which would break the image-metadata route.Compatibility:
NODE_OPTIONS=--openssl-legacy-providerinnpm startstill works on Node 22; verified locally thatapp.jsboots under Node 22.12 (only autil._extenddeprecation warning). Conflicts with the sibling base-image PRs on the same line; whichever lands, this tag should be preferred since the 18.x one no longer receives security rebuilds.Devin session (requested by automation)
Devin-Org: engineering