paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

chore(security): bump frontend nginx to r4 — close 4 HTTP/2 & module CVEs

Browse Source 
Trivy flagged nginx 1.28.3-r1 in the frontend image (alerts #371-374):
- CVE-2026-42055 (HIGH) HTTP/2 heap overflow
- CVE-2026-49975 (HIGH) HTTP/2 DoS
- CVE-2026-9256  (HIGH) rewrite_module code exec / DoS
- CVE-2026-48142 (MED)  charset_module memory disclosure

All fixed in nginx 1.28.3-r4. The Dockerfile already ran 'apk upgrade
--no-cache', but the pushed image predated the fixed package and the layer
was cached on r1. Add an explicit nginx upgrade to force the layer to rebuild
against the current Alpine repos (which now carry r4).
This commit is contained in:
Paul Nothaft
2026-07-02 17:14:29 +02:00
parent 24c287d051
commit 12a9d963f5
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/Dockerfile
+5 -2
View File
@@ -32,8 +32,11 @@ RUN npm run build
# Production stage (Alpine 3.23 with OpenSSL 3.5.5, patched libexpat) # Production stage (Alpine 3.23 with OpenSSL 3.5.5, patched libexpat)
FROM nginx:1.28-alpine FROM nginx:1.28-alpine
# Upgrade all packages to fix security vulnerabilities (OpenSSL, libexpat, BusyBox CVEs) # Upgrade all Alpine packages for security fixes. The explicit nginx upgrade
RUN apk upgrade --no-cache # closes the HTTP/2 + rewrite/charset CVEs (CVE-2026-42055 / -49975 / -9256 /
# -48142, fixed in nginx 1.28.3-r4) and busts any cached layer still carrying
# the vulnerable r1 build.
RUN apk upgrade --no-cache && apk add --no-cache --upgrade nginx
# Install runtime dependencies. `gettext` provides envsubst, used by # Install runtime dependencies. `gettext` provides envsubst, used by
# docker-entrypoint.sh for the BRAND_TITLE / BRAND_DESCRIPTION runtime # docker-entrypoint.sh for the BRAND_TITLE / BRAND_DESCRIPTION runtime