[container-image-scan] Container findings for node:lts-alpine

[github-actions]

Summary

Image: node:lts-alpine
Pinned reference: node:lts-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43

Severity	Count
Critical	1
High	4
Medium	7
Low	2

License violations: 29 packages.

Remediation

• Upgrade tar (npm) to 7.5.21 (fixes Critical GHSA-23hp-3jrh-7fpw and the remaining Medium tar CVEs).
• Upgrade brace-expansion to 5.0.8 (fixes High GHSA-mh99-v99m-4gvg and GHSA-3jxr-9vmj-r5cp).
• Upgrade undici to 6.27.0 (fixes High GHSA-vxpw-j846-p89q and the related Low/Medium findings).
• No fix currently published for busybox/ssl_client (Medium, Alpine); monitor Alpine security advisories.
• Review the 29 GPL/LGPL/BlueOak license violations against distribution policy.

Vulnerabilities (all severities)

14 vulnerabilities — click to expand

[Critical] GHSA-23hp-3jrh-7fpw: tar@7.5.16 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
[High] GHSA-3jxr-9vmj-r5cp: brace-expansion@5.0.6 (fix: 5.0.7) (GHSA-3jxr-9vmj-r5cp)
[High] GHSA-8x88-c5mf-7j5w: tar@7.5.16 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
[High] GHSA-mh99-v99m-4gvg: brace-expansion@5.0.6 (fix: 5.0.8) (GHSA-mh99-v99m-4gvg)
[High] GHSA-vxpw-j846-p89q: undici@6.26.0 (fix: 6.27.0) (GHSA-vxpw-j846-p89q)
[Low] GHSA-35p6-xmwp-9g52: undici@6.26.0 (fix: 6.27.0) (GHSA-35p6-xmwp-9g52)
[Low] GHSA-g8m3-5g58-fq7m: undici@6.26.0 (fix: 6.27.0) (GHSA-g8m3-5g58-fq7m)
[Medium] CVE-2025-60876: busybox-binsh@1.37.0-r31 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: busybox@1.37.0-r31 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: ssl_client@1.37.0-r31 ((nvd.nist.gov/redacted)
[Medium] GHSA-gvwx-54wh-qm9j: tar@7.5.16 (fix: 7.5.17) (GHSA-gvwx-54wh-qm9j)
[Medium] GHSA-p88m-4jfj-68fv: undici@6.26.0 (fix: 6.27.0) (GHSA-p88m-4jfj-68fv)
[Medium] GHSA-r292-9mhp-454m: tar@7.5.16 (fix: 7.5.21) (GHSA-r292-9mhp-454m)
[Medium] GHSA-w8wr-v893-vjvp: tar@7.5.16 (fix: 7.5.18) (GHSA-w8wr-v893-vjvp)

License policy violations

29 packages — click to expand

alpine-baselayout-data@3.7.2-r1 (GPL-2.0-only)
alpine-baselayout@3.7.2-r1 (GPL-2.0-only)
apk-tools@3.0.6-r0 (GPL-2.0-only)
busybox-binsh@1.37.0-r31 (GPL-2.0-only)
busybox@1.37.0-r31 (GPL-2.0-only)
ca-certificates-bundle@20260611-r0 (MPL-2.0)
chownr@3.0.0 (BlueOak-1.0.0)
common-ancestor-path@2.0.0 (BlueOak-1.0.0)
glob@13.0.6 (BlueOak-1.0.0)
isexe@4.0.0 (BlueOak-1.0.0)
libapk@3.0.6-r0 (GPL-2.0-only)
libgcc@15.2.0-r5 (LGPL-2.1-or-later, GPL-2.0-or-later)
libstdc++@15.2.0-r5 (GPL-2.0-or-later, LGPL-2.1-or-later)
lru-cache@11.5.1 (BlueOak-1.0.0)
minimatch@10.2.5 (BlueOak-1.0.0)
minipass-flush@1.0.6 (BlueOak-1.0.0)
minipass@7.1.3 (BlueOak-1.0.0)
musl-utils@1.2.6-r2 (GPL-2.0-or-later)
node@24.19.0 (no licenses found)
npm@11.17.0 (Artistic-2.0)
path-scurry@2.0.2 (BlueOak-1.0.0)
qrcode-terminal@0.12.0 (Apache 2.0)
scanelf@1.3.9-r1 (GPL-2.0-only)
spdx-exceptions@2.5.0 (CC-BY-3.0)
spdx-license-ids@3.0.23 (CC0-1.0)
ssl_client@1.37.0-r31 (GPL-2.0-only)
tar@7.5.16 (BlueOak-1.0.0)
yallist@5.0.0 (BlueOak-1.0.0)
zlib@1.3.2-r0 (Zlib)

Generated by 🛡️ Daily Container Image Security Scan · auto · 318.8 AIC · ⌖ 12.4 AIC · ⊞ 6.4K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.89 AIC · ⌖ 6.29 AIC · ⊞ 10.1K · ◷