Published Docker image is built on node:18-alpine, end-of-life since 2025-04-30

[kobihikri]

Hello, and thank you for NextChat.

The published Docker image is built on a Node line that stopped receiving security fixes fifteen months ago, and I think it's worth a look.

What I observed

Dockerfile builds every stage from one base, including the one that becomes the image:

 1:  FROM node:18-alpine AS base
 3:  FROM base AS deps
14:  FROM base AS builder
28:  FROM base AS runner      <-- the shipped stage
47:  EXPOSE 3000

So runner inherits node:18-alpine. This isn't a build-only base that gets discarded — it's what ships, via .github/workflows/docker.yml.

Node 18 reached end-of-life on 2025-04-30. The supported lines today are 22, 24 and 26.

Why that matters more than a version number

Node.js states the consequence directly in its security-release notes:

"It's important to note that End-of-Life versions are always affected when a security release occurs."

The June 2026 release fixed twelve CVEs, patched into 22.x, 24.x and 26.x — and not into 18.x:

CVE	Severity
CVE-2026-48933	HIGH	WebCrypto AES integer overflow → remote process abort (DoS)
CVE-2026-48618	HIGH	Unicode dot separator → TLS wildcard-depth authentication bypass
CVE-2026-48934	Medium	TLS host identity verification bypass via session reuse
CVE-2026-48928	Medium	Uppercase SNI matching → mTLS authorization bypass
CVE-2026-48615	Medium	Proxy credentials leaked in ERR_PROXY_TUNNEL error message

The July 2026 release, published this week, again patched only 26.x/24.x/22.x, with "the highest severity issue fixed in this release is HIGH." That's one release out of fifteen months of them.

Why nothing would have told you

node:18-alpine keeps resolving perfectly well — it just stops being fixed, silently. Dependabot's docker ecosystem is documented as doing version updates but not security updates, so a base image going end-of-life raises no alert at all.

What I did NOT check

• I did not pull or scan the published image; this is an analysis of the Dockerfile that builds it.
• I did not determine which of those CVEs are reachable in NextChat's usage, and I'm not claiming any of them is exploitable here. The narrower claim is that an end-of-life runtime ships and structurally cannot receive these fixes.
• I did not assess Alpine's own package set separately.

Suggestion

Moving the base to node:22-alpine or node:24-alpine would put it back on a patched line. I'm happy to open the PR if that's useful — it's a one-line change plus a build/test pass for the major bump.

Disclosure: AI-assisted (Claude Opus 5). I verified the Dockerfile stages, the Node EOL dates from endoflife.date, and the CVE list from nodejs.org myself before posting.