Skip to content

Commit 8e7fdf4

Browse files
committed
fix: update npm in Docker image to fix cross-spawn vulnerability
Updates npm to latest version in the Docker image to fix CVE-2024-21538 (cross-spawn regular expression denial of service). The vulnerability exists in npm's dependencies in the base Node.js image. Updating npm to latest version includes the fixed version of cross-spawn (7.0.5+). Severity: HIGH Fixed in: cross-spawn 7.0.5
1 parent aa2c005 commit 8e7fdf4

1 file changed

Lines changed: 3 additions & 0 deletions

File tree

Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ FROM node:24-alpine
22

33
WORKDIR /app
44

5+
# Update npm to latest version to fix vulnerabilities
6+
RUN npm install -g npm@latest
7+
58
# Copy package files
69
COPY package*.json ./
710

0 commit comments

Comments
 (0)