Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Frontend container image ships brotli-libs 1.2.0-r1 (CVE-2026-111497, CISA KEV) and cannot pick up the fix

Open Beginner friendly
  • Is something wrong?
#2,046 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@ejacobhayes is already working on this.

Since Oct 30, 2026.

  • #2047 by @ejacobhayes — open

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
85/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, nginx
Domain
devops

Research direction

Read docker/Dockerfile.alpine and check its current FROM image against the nginx/nginx-unprivileged:1.31.8-alpine3.24 tag named in the issue. Update the base image reference, then build or inspect the frontend image and verify that brotli-libs is 1.2.1-r0. The issue reports no tests; completion means the frontend image uses an updateable base and contains the fixed package.

Written by the indexing model from the issue text.

Description

defect in triage
Current Behavior

dependencytrack/frontend:5.2.1 and the current 5-snapshot image both contain the Alpine package brotli-libs 1.2.0-r1, which is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-27. Alpine 3.24 has shipped the fixed package brotli-libs 1.2.1-r0 since 2026-10-22, but the frontend image inherits whatever its base image contains.

docker/Dockerfile.alpine pins nginxinc/nginx-unprivileged:1.31.7-alpine3.24. The nginx project now publishes unprivileged images for releases after 1.31.7 only under the nginx/nginx-unprivileged namespace (see the note in https://github.com/nginx/docker-nginx-unprivileged#readme). The nginxinc namespace has no 1.31.8 tag, so Dependabot has nothing to bump and the image will keep shipping the vulnerable package on every release and nightly build.

nginx/nginx-unprivileged:1.31.8-alpine3.24 (digest sha256:03df07e5931f8374d440bd62243a5ce9b24719715ef6fc4c9c626a5f1dbef417) contains brotli-libs 1.2.1-r0.

Steps to Reproduce
  1. docker run --rm --entrypoint sh dependencytrack/frontend:5.2.1 -c 'apk list -I | grep brotli'
    Output: brotli-libs-1.2.0-r1
  2. Scan the image with Trivy. CVE-2026-111497 is reported for brotli-libs with fixed version 1.2.1-r0.
  3. docker run --rm --entrypoint sh nginx/nginx-unprivileged:1.31.8-alpine3.24 -c 'apk list -I | grep brotli'
    Output: brotli-libs-1.2.1-r0
Expected Behavior

The frontend image is built from a base that still receives updates, so Alpine security fixes reach release and snapshot images. Moving the FROM line to nginx/nginx-unprivileged:1.31.8-alpine3.24 does that and clears the finding. I can open a pull request for main, 5.2.x and 4.14.x.

Dependency-Track Frontend Version

5.x

Browser

Google Chrome

Browser Version

No response

Operating System

Windows

Checklist
Dominant language
Vue
Stars
183
Forks
260
Avg merge
4h 28m
Merged PRs (30d)
154

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DependencyTrack/frontend

All issues in DependencyTrack/frontend

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.