From 12a9d963f53bcc647eb5d5779fa34970882074e0 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Thu, 2 Jul 2026 17:14:29 +0200 Subject: [PATCH] =?UTF-8?q?chore(security):=20bump=20frontend=20nginx=20to?= =?UTF-8?q?=20r4=20=E2=80=94=20close=204=20HTTP/2=20&=20module=20CVEs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trivy flagged nginx 1.28.3-r1 in the frontend image (alerts #371-374): - CVE-2026-42055 (HIGH) HTTP/2 heap overflow - CVE-2026-49975 (HIGH) HTTP/2 DoS - CVE-2026-9256 (HIGH) rewrite_module code exec / DoS - CVE-2026-48142 (MED) charset_module memory disclosure All fixed in nginx 1.28.3-r4. The Dockerfile already ran 'apk upgrade --no-cache', but the pushed image predated the fixed package and the layer was cached on r1. Add an explicit nginx upgrade to force the layer to rebuild against the current Alpine repos (which now carry r4). --- frontend/Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 9cfbd822..586e4754 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -32,8 +32,11 @@ RUN npm run build # Production stage (Alpine 3.23 with OpenSSL 3.5.5, patched libexpat) FROM nginx:1.28-alpine -# Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs) -RUN apk upgrade --no-cache +# Upgrade all Alpine packages for security fixes. The explicit nginx upgrade +# closes the HTTP/2 + rewrite/charset CVEs (CVE-2026-42055 / -49975 / -9256 / +# -48142, fixed in nginx 1.28.3-r4) and busts any cached layer still carrying +# the vulnerable r1 build. +RUN apk upgrade --no-cache && apk add --no-cache --upgrade nginx # Install runtime dependencies. `gettext` provides envsubst, used by # docker-entrypoint.sh for the BRAND_TITLE / BRAND_DESCRIPTION runtime