Node.js 26.13.0 (runtime). Tags: 26.13.0-20261109.147, 26, 26.13, 26.13.0, latest. Index digest sha256:5f77e6b134bff56eb3a0254a1f64aa1406e227bfa26e208f691e457c80fa650e.
Vulnerabilities · SBOM · Hardening profile
High: 1 (Grype)
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-84243 | High | glibc-2.44 | 2.44-r14 | glibc-2.44 2.44-r14 | no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside npm, for example, comes from the npm package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
One SPDX SBOM per architecture, also attached to the image as a signed attestation.
Download sbom-x86_64.spdx.json · 59.2 MB compressed, 156.6 MB installed
| Package | Version | License |
|---|---|---|
bash | 5.3-r14 | GPL-3.0-or-later |
busybox | 1.38.0-r3 | GPL-2.0-only |
c-ares | 1.34.9-r0 | MIT |
ca-certificates-bundle | 20261020-r0 | MPL-2.0 AND MIT |
glibc-2.44 | 2.44-r14 | LGPL-2.1-or-later |
glibc-2.44-locale-posix | 2.44-r14 | LGPL-2.1-or-later |
icu79-data-full | 79.1-r1 | MIT |
ld-linux-2.44 | 2.44-r14 | LGPL-2.1-or-later |
libbrotlicommon1 | 1.2.1-r3 | MIT |
libbrotlidec1 | 1.2.1-r3 | MIT |
libbrotlienc1 | 1.2.1-r3 | MIT |
libcrypt1-2.44 | 2.44-r14 | LGPL-2.1-or-later |
libgcc | 16.2.0-r3 | GPL-3.0-or-later WITH GCC-exception-3.1 |
libicu79 | 79.1-r1 | MIT |
libnghttp2-14 | 1.71.0-r0 | MIT |
libstdc++ | 16.2.0-r3 | GPL-3.0-or-later WITH GCC-exception-3.1 |
libuv | 1.53.0-r0 | MIT AND ISC |
libxcrypt | 4.5.2-r8 | GPL-2.0-or-later AND LGPL-2.1-or-later |
ncurses | 6.6.20261107-r0 | MIT |
ncurses-terminfo-base | 6.6.20261107-r0 | MIT |
nodejs-26 | 26.13.0-r1 | MIT |
openssl-4.0-libcrypto | 4.0.3-r8 | Apache-2.0 |
openssl-4.0-libssl | 4.0.3-r8 | Apache-2.0 |
openssl-provider-legacy-allowed | 4.1.0-r0 | Apache-2.0 |
tzdata | 2026f-r0 | CC-PDDC |
wolfi-baselayout | 20230201-r31 | MIT |
zlib | 1.3.2.1_rc20260921-r2 | MPL-2.0 AND MIT |
Download sbom-aarch64.spdx.json · 56.7 MB compressed, 154.2 MB installed
| Package | Version | License |
|---|---|---|
bash | 5.3-r14 | GPL-3.0-or-later |
busybox | 1.38.0-r3 | GPL-2.0-only |
c-ares | 1.34.9-r0 | MIT |
ca-certificates-bundle | 20261020-r0 | MPL-2.0 AND MIT |
glibc-2.44 | 2.44-r14 | LGPL-2.1-or-later |
glibc-2.44-locale-posix | 2.44-r14 | LGPL-2.1-or-later |
icu79-data-full | 79.1-r1 | MIT |
ld-linux-2.44 | 2.44-r14 | LGPL-2.1-or-later |
libbrotlicommon1 | 1.2.1-r3 | MIT |
libbrotlidec1 | 1.2.1-r3 | MIT |
libbrotlienc1 | 1.2.1-r3 | MIT |
libcrypt1-2.44 | 2.44-r14 | LGPL-2.1-or-later |
libgcc | 16.2.0-r3 | GPL-3.0-or-later WITH GCC-exception-3.1 |
libicu79 | 79.1-r1 | MIT |
libnghttp2-14 | 1.71.0-r0 | MIT |
libstdc++ | 16.2.0-r3 | GPL-3.0-or-later WITH GCC-exception-3.1 |
libuv | 1.53.0-r0 | MIT AND ISC |
libxcrypt | 4.5.2-r8 | GPL-2.0-or-later AND LGPL-2.1-or-later |
ncurses | 6.6.20261107-r0 | MIT |
ncurses-terminfo-base | 6.6.20261107-r0 | MIT |
nodejs-26 | 26.13.0-r1 | MIT |
openssl-4.0-libcrypto | 4.0.3-r8 | Apache-2.0 |
openssl-4.0-libssl | 4.0.3-r8 | Apache-2.0 |
openssl-provider-legacy-allowed | 4.1.0-r0 | Apache-2.0 |
tzdata | 2026f-r0 | CC-PDDC |
wolfi-baselayout | 20230201-r31 | MIT |
zlib | 1.3.2.1_rc20260921-r2 | MPL-2.0 AND MIT |
Derived from the DISA General Purpose Operating System SRG; not an official DISA STIG for containers.
| Architecture | Passed / applicable | Not applicable | Report |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | OpenSCAP report |
| aarch64 | 85 / 91 (93.4%) | 107 | OpenSCAP report |