Dockerfile runtime is node:14, end-of-life since April 2023

[kobihikri]

Hello, and thank you for this project.

The image built by Dockerfile runs on a base that no longer receives security fixes, and I thought it worth flagging.

What I observed

Dockerfile is single-stage:

 2:  FROM node:14
17:  EXPOSE 80
20:  CMD ["npm", "start"]

The base of the final stage is what becomes the image, so this is what ships — not a builder stage that gets discarded. I checked that specifically; several other candidates I looked at today turned out to use an old base only in a build stage whose final image was nginx or distroless, and I set those aside.

node:14 is on a line that reached end-of-life on 2023-04-30.
Node 14 has been out of support for over three years — the supported lines today are 22, 24 and 26.

What end-of-life means here

Node.js states the consequence in its own security-release notes:

"It's important to note that End-of-Life versions are always affected when a security release occurs."

The June 2026 release fixed twelve CVEs into 22.x, 24.x and 26.x, with older lines excluded:

CVE	Severity
CVE-2026-48933	HIGH	WebCrypto AES integer overflow → remote process abort (DoS)
CVE-2026-48618	HIGH	Unicode dot separator → TLS wildcard-depth authentication bypass
CVE-2026-48934	Medium	TLS host identity verification bypass via session reuse
CVE-2026-48928	Medium	Uppercase SNI matching → mTLS authorization bypass
CVE-2026-48615	Medium	Proxy credentials leaked in ERR_PROXY_TUNNEL error message

The July 2026 release, published this week, again patched only 26.x/24.x/22.x, with "the highest severity issue fixed in this release is HIGH."

Why nothing would have told you

The tag keeps resolving perfectly well — it simply stops being fixed, and nothing announces that. Dependabot's docker ecosystem is documented as supporting version updates but not security updates, so a base going end-of-life produces no alert at all.

What I did NOT check

• I did not pull or scan the published image; this is an analysis of the Dockerfile that builds it.
• I did not determine which of those CVEs are reachable in your usage, and I'm not claiming any is exploitable here. The narrower claim is that an end-of-life runtime ships and structurally cannot receive these fixes.
• The base distribution's own package set was not assessed separately.

Suggestion

Moving to a currently-supported line would put it back on a patched runtime. Happy to open the PR if that's useful.

Disclosure: AI-assisted (Claude Opus 5). I verified the Dockerfile stages, the EOL dates from endoflife.date, and the CVE lists from the upstream projects myself before posting.