Repository navigation
Docker image: rebuild on Node 22.23.4 (CVE-2026-111497) #6456
Description
I run the official dspace-10.1-dist image, and the Node.js it ships is 22.23.2. That build is affected by CVE-2026-111497, a vulnerability in Node's Brotli decoder that can lead to remote code execution, fixed on 21 October 2026 in Node 22.23.4, 24.22.1, and 26.12.1 (https://nodejs.org/en/blog/vulnerability). Node 14, 16, 18, 19, 20, 21, 23, and 25 are end of life and will not get this patch, so the runtime needs to be on 22.23.4, 24.22.1, or 26.12.1. The Dockerfile tracks a floating Node tag (floating node:22-alpine; rebuild needed), and the tag you have published was built before the security release. Rebuilding and publishing the image so it picks up Node 22.23.4 would fix this. Pinning that exact version would keep the next build from drifting. I am happy to open a pull request if you want one.
Activity
tdonohue commentedon Oct 28, 2026
@mahfuz-rahman007 : At this time, we do not have any production-ready Docker images for DSpace. The image you are referencing is a development-only image. See the big warning in the README regarding these Docker Images / Docker Compose scripts: https://github.com/DSpace/dspace-angular/blob/main/docker/README.md
We do not have a workflow in place to republish any of these tagged images, as the tagged images are built based on (static) tags in GitHub. This is one of the main reasons we don't offer any production-level support for these images... the images are always a "point in time" and we don't have an automated way to regenerate them using an existing tag. So, we don't currently have a method for automatically rebuilding & republishing the existing
dspace-10.1-distimage. It is currently a static image.If you want an auto-updating image, we recommend either:
dpace-10_x-distimage. But this is a "floating image" which always uses the latest 10.x code. So, there is a risk that using this floating image would fail in production scenarios.lgeggleston commentedon Oct 28, 2026
Closing this based on Tim's comment. However, we can always reopen if it's helpful for further discussion or there's another step to take. Thank you!