Security: stable v0.30.8 still ships [email protected] (critical RCE advisories), and image base/tooling carry fixable CVEs

Open
  • Is something wrong?
#5,736 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
docker, next.js, node.js, typescript
Domain
devops, infrastructure, security

Research direction

Read apps/dokploy/package.json and the image build files to trace the Next.js version and bundled tooling; compare the stable and canary image scans with the listed fixed versions. The report says #5517 already fixes the JavaScript dependencies on canary, and a PR for the image base and tooling is planned. Done means the stable release and published image contain the reported fixes, with scans confirming the listed fixable CVEs are addressed.

Written by the indexing model from the issue text.

Description

security
To Reproduce
  1. Check apps/dokploy/package.json on main (v0.30.8): "next": "16.3.0".
  2. Scan the published images, e.g. trivy image --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed dokploy/dokploy:v0.30.7 and dokploy/dokploy:canary.
Current vs. Expected behavior

Current — stable release (main / v0.30.8) still ships [email protected], which is affected by public critical advisories:

Package Installed Fixed Advisories
next 16.3.0 16.3.8 GHSA-2xp9-vwfh-vxw4 (unauthenticated RCE in Image Optimization w/ AVIF), GHSA-vcvr-r3jv-pc5j (RCE in next/og ImageResponse), CVE-2026-94483 (SSRF in Image Optimization), CVE-2026-75604
shell-quote 1.8.3 1.9.0 CVE-2026-9277, CVE-2026-13311 (command injection)
proxy-addr 2.0.7 2.0.8 CVE-2026-90711
tar 6.2.1 / 7.4.3 / 7.5.2 7.5.21 CVE-2026-23745 and others

These are already fixed on canary by #5517, but that hasn't reached a release yet (release PR #5689 is still open). Since the Dokploy UI is usually internet-facing and has access to the Docker socket, an RCE here means full host compromise.

Current — canary: the JS dependencies are clean, but the image is still built on pinned, older tooling that carries HIGH/CRITICAL fixable CVEs:

  • node:24.4.0-slim base (July 2025, Debian 12.11): the Node.js runtime has received many security releases since (latest is 24.22.1), and OS packages are stale (libgnutls30 with CRITICAL CVE-2026-42010 auth bypass, libpam* CVE-2025-6020, libpcre2-8-0, gpgv, git-lfs).
  • [email protected] (installed in the runtime image via corepack): 14 HIGH advisories, fixed in 10.34.x.
  • buildpacksio/pack:0.39.1: Go 1.25.5 stdlib (CRITICAL), golang.org/x/crypto 0.45, go-git 5.16.4, buildkit 0.26.1, containerd …
  • railpack 0.15.4 (Go 1.23.4, grpc 1.68.1 CRITICAL CVE-2026-33186) and Docker 28.5.2 (dockerd: Go 1.25.3, grpc 1.72.2, containerd 2.1.4). These need a bigger, behaviour-affecting bump so I'm only flagging them here.

Expected:

  1. A patch release that ships #5517 (Next.js 16.3.8 and friends) to stable.
  2. The image base / bundled tooling bumped so the published image doesn't ship known-fixed CVEs.
Provide environment information
Dokploy: v0.30.7 (self-hosted, Docker Swarm) scanned; v0.30.8 checked via main's package.json (next 16.3.0); dokploy/dokploy:canary image (built 2026-10-16) scanned
OS: Ubuntu 24.04, kernel 6.8
Scanner: Trivy (latest DB, 2026-10-22), HIGH/CRITICAL with a fix available only
Which area(s) are affected?

Installation, Docker

Are you deploying the applications where Dokploy is installed or on a remote server?

Same server where Dokploy is installed

Additional context

All of the above are publicly disclosed CVEs in third-party dependencies (no new Dokploy-specific vulnerability), hence a public issue. Previous similar reports: #3225, #3171.

Will you send a PR to fix it?

Yes — PR for point 2 (Node base image, pnpm, pack) coming up against canary.

Dominant language
TypeScript
Stars
38.2k
Forks
3.1k
Avg merge
2d 11h
Merged PRs (30d)
65

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Dokploy/dokploy

All issues in Dokploy/dokploy

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.