paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(security): upgrade Alpine base image to fix libpng and c-ares CVEs

Browse Source 
Update frontend Dockerfile to use nginx:1.27-alpine3.22 which includes:
- libpng >= 1.6.51 (fixes CVE-2025-64720, CVE-2025-65018, CVE-2025-64505, CVE-2025-64506)
- c-ares >= 1.34.5 (fixes CVE-2025-31498)

Remove redundant edge repository pull since Alpine 3.22 packages are already patched.
This commit is contained in:
Paul Nothaft
2026-01-03 23:52:38 +01:00
parent 6033461be1
commit b706eeb5d3
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/Dockerfile
+5 -5
View File
@@ -30,13 +30,13 @@ COPY . .
# Build the application
RUN npm run build
# Production stage (use Alpine with patched libpng)
FROM nginx:1.27-alpine3.21
# Production stage (use Alpine 3.22+ with patched libpng/c-ares)
FROM nginx:1.27-alpine3.22
# Upgrade all packages to fix security vulnerabilities (BusyBox CVEs)
# Upgrade all packages to fix security vulnerabilities
# This ensures libpng >= 1.6.51 (fixes CVE-2025-64720, CVE-2025-65018, CVE-2025-64505, CVE-2025-64506)
# and c-ares >= 1.34.5 (fixes CVE-2025-31498)
RUN apk upgrade --no-cache
# Ensure libpng includes CVE fixes (pull patched version from edge)
RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main 'libpng>=1.6.51-r0'
# Install runtime dependencies
RUN apk add --no-cache curl