Rebuilds keep the official PHP image's Alpine packages, so brotli-libs CVE-2026-111497 stays unfixed #733

Steps To Reproduce

1. Pull the current floating tag, serversideup/php:8.5-frankenphp-alpine (v5.0.3, digest sha256:fd5c5d89585f322c62d2baa4df5eed418ecd19197ffe6626f7011f6c6ab7965e, created 2026-10-23T12:51:07Z).

2. List the installed brotli package and every upgradable package:

   docker run --rm --user root --entrypoint sh serversideup/php:8.5-frankenphp-alpine \
     -c 'apk list -I | grep "^brotli-libs-"; apk update -q; apk list -u'

3. Output (the same on linux/amd64 and linux/arm64):

   brotli-libs-1.2.0-r1 x86_64 {brotli} (MIT) [installed]
   brotli-libs-1.2.1-r0 x86_64 {brotli} (MIT) [upgradable from: brotli-libs-1.2.0-r1]
   

Outcome

What did you expect?

SECURITY.md and the upgrade guide say that rebuilds of floating tags pick up the latest operating system security patches. Alpine committed brotli 1.2.1-r0 to its 3.24-stable branch on 2026-10-22 at 02:32 UTC, and v5.0.3 was built about 34 hours later. I expected the image to contain brotli-libs 1.2.1-r0.

What happened instead?

The image contains brotli-libs 1.2.0-r1. That version has CVE-2026-111497, an out-of-bounds write in the Brotli decoder, which Alpine fixed in 1.2.1-r0. It is the only upgradable package in the image.

The cause appears to be this:

• brotli-libs comes from the official php:8.5-zts-alpine3.24 base image, which was built on 2026-10-21 at 23:16 UTC (before the fix) and still contains 1.2.0-r1.
• docker-php-serversideup-dep-install-alpine runs apk update and then apk add --no-cache "$@". apk add does not upgrade packages that are already installed.
• So a release build or a weekly rebuild gets an operating system fix for these packages only after Docker Hub rebuilds the official image.

The Debian script has the same shape (apt-get update, then apt-get install -y).

Affected Docker Images

• serversideup/php:8.5-frankenphp-alpine (v5.0.3), linux/amd64 and linux/arm64
• serversideup/php:8.5-fpm-nginx-alpine (v5.0.3), linux/amd64 and linux/arm64

I checked only these two. The other Alpine variations build on the same base, so they probably have the same problem.

Anything else?

Suggested fix: upgrade the distribution packages at build time, for example with a RUN apk upgrade --no-cache step in each variation's Dockerfile and apt-get upgrade -y on Debian. Then every release and every weekly rebuild includes the fixes that the distribution has already published. Draft PR #728 could change this if it installs the operating system packages itself, but I did not find a package upgrade in its diff.

Until then, the workaround is the step from your upgrade guide: RUN apk upgrade --no-cache in the downstream Dockerfile.