From f8c2acf0747d9a24e64554e201f9e87c1e41061f Mon Sep 17 00:00:00 2001 From: Mike Fortman Date: Thu, 22 Oct 2026 16:29:55 -0500 Subject: [PATCH] chore: Oct 10th Cves (#2535) * fix CVE-2026-15157, CVE-2026-16728, CVE-2026-16729 * fixes langflow cves (cherry picked from commit e9c629f044ccca9245b93f642ffabceb95a834be) --- Dockerfile.frontend | 11 +++++++++-- Dockerfile.langflow | 20 ++++++++++++++++---- 2 files changed, 25 insertions(+), 6 deletions(-) diff --git a/Dockerfile.frontend b/Dockerfile.frontend index 7046dd386..36b022224 100644 --- a/Dockerfile.frontend +++ b/Dockerfile.frontend @@ -53,7 +53,13 @@ USER 0 ARG OPENRAG_FRONTEND_BASE_PATH -RUN microdnf update -y && microdnf clean all && rm -rf /var/cache/yum +# The npm CLI is only needed to install and build, so the runtime stage drops +# it. Its bundled dependencies (e.g. undici via node-gyp) otherwise ship in the +# image and get flagged by scanners (CVE-2026-15157, CVE-2026-16728, +# CVE-2026-16729). +RUN microdnf update -y \ + && microdnf remove -y nodejs24-npm \ + && microdnf clean all && rm -rf /var/cache/yum ENV NODE_ENV=production \ NEXT_TELEMETRY_DISABLED=1 \ @@ -78,4 +84,5 @@ COPY --from=builder --chown=1001:0 /opt/app-root/src/biome.json* ./ EXPOSE 3000 9090 USER 1001 -CMD ["npm", "start"] +# Run Next.js directly with node: npm is not installed in this stage. +CMD ["node", "node_modules/next/dist/bin/next", "start"] diff --git a/Dockerfile.langflow b/Dockerfile.langflow index 3dc823001..57b3c3802 100644 --- a/Dockerfile.langflow +++ b/Dockerfile.langflow @@ -40,24 +40,36 @@ RUN pip install --no-cache-dir --upgrade "pip>=26.1.2" \ && pip install --no-cache-dir uv USER root -# Upgrade libxml2 to patch CVE-2026-74860 and CVE-2026-86140 (fixed in -# 2.12.5-10.el10_2.4) in the base image. libxslt is the runtime library for the -# source-built lxml from the lxml-build stage. TODO: remove (see lxml-build). +# Patch base-image CVEs in system packages: +# libxml2 >= 2.12.5-10.el10_2.4: CVE-2026-74860, CVE-2026-86140. libxslt is +# the runtime library for the source-built lxml. TODO: remove (see lxml-build). +# expat >= 2.7.3-1.el10_2.5: CVE-2026-66046, CVE-2026-93990 +# npm 12.2.1 (bundles brace-expansion 5.0.12): CVE-2026-102276, CVE-2026-102278 RUN microdnf install -y 'libxml2 >= 2.12.5-10.el10_2.4' \ && microdnf install -y libxslt \ + && microdnf install -y 'expat >= 2.7.3-1.el10_2.5' \ + && npm install -g --no-audit --no-fund npm@12.2.1 \ + && npm cache clean --force \ && microdnf clean all \ && rm -rf /var/cache/yum \ && mkdir -p /app/langflow-data \ && chmod 0777 /app/langflow-data USER 1000 +# Minimum versions that patch base-image CVEs: +# pypdf 6.19.0: CVE-2026-102998, CVE-2026-102999, CVE-2026-103000 +# pyjwt 2.14.0: CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, +# CVE-2026-102271, CVE-2026-102272, CVE-2026-102273 +# urllib3 2.8.0: CVE-2026-97687, CVE-2026-97689 RUN pip install --no-cache-dir \ --extra-index-url https://download.pytorch.org/whl/cpu \ torch==2.13.0 \ torchvision==0.28.0 \ "transformers>=5.10.1,<6.0.0" \ "docling-core<3.0.0" \ - "pypdf>=6.16.1,<7.0.0" \ + "pypdf>=6.19.0,<7.0.0" \ + "pyjwt>=2.14.0,<3.0.0" \ + "urllib3>=2.8.0,<3.0.0" \ openai \ langchain-openai \ anthropic \