From 9c0e7709e046745abe8bcc4478d3acbce1fb7270 Mon Sep 17 00:00:00 2001
From: zethis <zethis@users.noreply.github.com>
Date: Thu, 14 May 2026 15:43:54 +0200
Subject: [PATCH] fix: upgrade nginx base image to fix CVE-2026-42945 (CVSS 9.2
 RCE)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch from nginx:stable-alpine (1.26.x, vulnerable) to nginx:1.31-alpine
which includes the fix for CVE-2026-42945, a heap buffer overflow in
ngx_http_rewrite_module allowing unauthenticated RCE.

Affected: nginx 0.6.27 – 1.30.0
Fixed in: nginx 1.30.1, 1.31.0
Ref: https://nginx.org/en/security_advisories.html
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 734bd73d35..afb0050548 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -10,7 +10,7 @@ COPY . .
 RUN pnpm build
 
 # production stage
-FROM nginx:stable-alpine AS production-stage
+FROM nginx:1.31-alpine AS production-stage
 COPY --from=build-stage /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80