kadet-hub
Image security report: rocketchat recipe
rocketchat: grade F, 210 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 5, HIGH 72, MEDIUM 111, LOW 22, UNKNOWN 0. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
docker.io/rocketchat/rocket.chat:8.9.1@sha256:180984d4a2b0e9348484f662cf9c34f549aacbe744e0ad907ccb871e85475f0d
CRITICAL 5, HIGH 72, MEDIUM 111, LOW 22, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-59873 | CRITICAL | tar | 6.2.1 | 7.5.19 |
| CVE-2026-59873 | CRITICAL | tar | 6.2.1 | 7.5.19 |
| CVE-2026-90711 | CRITICAL | proxy-addr | 2.0.7 | 2.0.8 |
| CVE-2026-90711 | CRITICAL | proxy-addr | 2.0.7 | 2.0.8 |
| GHSA-cg2g-xh64-v4q7 | CRITICAL | dompurify | 3.4.14 | 3.4.17 |
| CVE-2025-47934 | HIGH | openpgp | 5.11.1 | 5.11.3, 6.1.1 |
| CVE-2025-71329 | HIGH | image-size | 1.2.1 | 2.0.3 |
| CVE-2025-71330 | HIGH | image-size | 1.2.1 | 2.0.3 |
| CVE-2026-101898 | HIGH | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101901 | HIGH | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101903 | HIGH | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101905 | HIGH | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101906 | HIGH | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101907 | HIGH | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101909 | HIGH | axios | 0.33.0 | 0.34.0, 1.20.0 |
| CVE-2026-101909 | HIGH | axios | 1.18.0 | 0.34.0, 1.20.0 |
| CVE-2026-101916 | HIGH | @grpc/grpc-js | 1.14.4 | 1.13.6, 1.14.5 |
| CVE-2026-102276 | HIGH | brace-expansion | 1.1.18 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 |
| CVE-2026-102276 | HIGH | brace-expansion | 2.1.4 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 |
| CVE-2026-102276 | HIGH | brace-expansion | 5.0.9 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 |
| CVE-2026-102278 | HIGH | brace-expansion | 1.1.18 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 |
| CVE-2026-102278 | HIGH | brace-expansion | 2.1.4 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 |
| CVE-2026-102278 | HIGH | brace-expansion | 5.0.9 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 |
| CVE-2026-109383 | HIGH | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109869 | HIGH | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-111181 | HIGH | body-parser | 1.20.3 | 2.4.0, 1.20.9 |
| CVE-2026-111181 | HIGH | body-parser | 1.20.6 | 2.4.0, 1.20.9 |
| CVE-2026-111181 | HIGH | body-parser | 2.3.0 | 2.4.0, 1.20.9 |
| CVE-2026-111755 | HIGH | follow-redirects | 1.16.0 | 1.16.1 |
| CVE-2026-111756 | HIGH | follow-redirects | 1.16.0 | 1.16.1 |
| CVE-2026-116689 | HIGH | follow-redirects | 1.16.0 | 1.16.2 |
| CVE-2026-118664 | HIGH | decode-uri-component | 0.2.2 | 0.5.1 |
| CVE-2026-118779 | HIGH | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-118782 | HIGH | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-119187 | HIGH | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-119188 | HIGH | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-119190 | HIGH | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-19534 | HIGH | undici | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| CVE-2026-23745 | HIGH | tar | 6.2.1 | 7.5.3 |
| CVE-2026-23745 | HIGH | tar | 6.2.1 | 7.5.3 |
| CVE-2026-23950 | HIGH | tar | 6.2.1 | 7.5.4 |
| CVE-2026-23950 | HIGH | tar | 6.2.1 | 7.5.4 |
| CVE-2026-24842 | HIGH | tar | 6.2.1 | 7.5.7 |
| CVE-2026-24842 | HIGH | tar | 6.2.1 | 7.5.7 |
| CVE-2026-26960 | HIGH | tar | 6.2.1 | 7.5.8 |
| CVE-2026-26960 | HIGH | tar | 6.2.1 | 7.5.8 |
| CVE-2026-27601 | HIGH | underscore | 1.13.7 | 1.13.8 |
| CVE-2026-29786 | HIGH | tar | 6.2.1 | 7.5.10 |
| CVE-2026-29786 | HIGH | tar | 6.2.1 | 7.5.10 |
| CVE-2026-31802 | HIGH | tar | 6.2.1 | 7.5.11 |
| CVE-2026-31802 | HIGH | tar | 6.2.1 | 7.5.11 |
| CVE-2026-44705 | HIGH | tmp | 0.2.3 | 0.2.6 |
| CVE-2026-45623 | HIGH | postcss | 8.5.1 | 8.5.12 |
| CVE-2026-59874 | HIGH | tar | 6.2.1 | 7.5.18 |
| CVE-2026-59874 | HIGH | tar | 6.2.1 | 7.5.18 |
| CVE-2026-67213 | HIGH | nanoid | 3.3.15 | 3.3.18, 5.1.6 |
| CVE-2026-67214 | HIGH | nanoid | 3.3.15 | 3.3.16, 5.1.16 |
| CVE-2026-73088 | HIGH | browserslist | 4.28.4 | 4.28.7 |
| CVE-2026-73089 | HIGH | browserslist | 4.28.4 | 4.28.7 |
| CVE-2026-73566 | HIGH | tar | 6.2.1 | 7.5.21 |
| CVE-2026-73566 | HIGH | tar | 6.2.1 | 7.5.21 |
| CVE-2026-73646 | HIGH | postcss | 8.5.1 | 8.5.18 |
| CVE-2026-73650 | HIGH | svgo | 2.8.2 | 2.8.3, 3.3.4, 4.0.2 |
| CVE-2026-82659 | HIGH | nodemailer | 8.0.3 | 9.0.1 |
| CVE-2026-82662 | HIGH | nodemailer | 8.0.3 | 8.0.8 |
| CVE-2026-84370 | HIGH | svgo | 2.8.2 | 2.8.4, 3.3.5, 4.1.0 |
| CVE-2026-85393 | HIGH | node-forge | 1.4.0 | |
| CVE-2026-87018 | HIGH | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-87776 | HIGH | compression | 1.7.4 | 1.8.2 |
| CVE-2026-90776 | HIGH | nodemailer | 9.1.1 | 10.0.5 |
| CVE-2026-93749 | HIGH | source-map-js | 1.2.1 | 1.2.2 |
| CVE-2026-93749 | HIGH | source-map-js | 1.2.1 | 1.2.2 |
| GHSA-2x7j-588g-ccc2 | HIGH | nodemailer | 8.0.3 | 9.1.0 |
| GHSA-mrv2-3pqr-j5jr | HIGH | dompurify | 3.4.14 | 3.4.17 |
| GHSA-v53p-9fqp-m79j | HIGH | nodemailer | 8.0.3 | 10.0.6 |
| GHSA-v53p-9fqp-m79j | HIGH | nodemailer | 9.1.1 | 10.0.6 |
| GHSA-wq5f-xc86-pv6w | HIGH | sharp | 0.35.4 | 0.35.5 |
| CVE-2025-15284 | MEDIUM | qs | 6.13.0 | 6.14.1 |
| CVE-2025-15284 | MEDIUM | qs | 6.13.0 | 6.14.1 |
| CVE-2025-27789 | MEDIUM | @babel/runtime | 7.20.7 | 7.26.10, 8.0.0-alpha.17 |
| CVE-2025-27789 | MEDIUM | @babel/runtime | 7.20.7 | 7.26.10, 8.0.0-alpha.17 |
| CVE-2025-27789 | MEDIUM | @babel/runtime | 7.20.7 | 7.26.10, 8.0.0-alpha.17 |
| CVE-2026-101899 | MEDIUM | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101900 | MEDIUM | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101902 | MEDIUM | axios | 0.33.0 | 0.34.0, 1.20.0 |
| CVE-2026-101902 | MEDIUM | axios | 1.18.0 | 0.34.0, 1.20.0 |
| CVE-2026-101904 | MEDIUM | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101908 | MEDIUM | axios | 1.18.0 | 1.20.0 |
| CVE-2026-101910 | MEDIUM | ip-address | 10.4.0 | 10.5.1 |
| CVE-2026-101910 | MEDIUM | ip-address | 10.5.0 | 10.5.1 |
| CVE-2026-101911 | MEDIUM | ip-address | 10.4.0 | 10.7.1 |
| CVE-2026-101911 | MEDIUM | ip-address | 10.5.0 | 10.7.1 |
| CVE-2026-101912 | MEDIUM | ip-address | 10.4.0 | 10.7.1 |
| CVE-2026-101912 | MEDIUM | ip-address | 10.5.0 | 10.7.1 |
| CVE-2026-101913 | MEDIUM | ip-address | 10.4.0 | 10.5.1 |
| CVE-2026-101913 | MEDIUM | ip-address | 10.5.0 | 10.5.1 |
| CVE-2026-102277 | MEDIUM | brace-expansion | 1.1.18 | 5.0.12, 3.0.9, 2.1.7, 1.1.21 |
| CVE-2026-102277 | MEDIUM | brace-expansion | 2.1.4 | 5.0.12, 3.0.9, 2.1.7, 1.1.21 |
| CVE-2026-102277 | MEDIUM | brace-expansion | 5.0.9 | 5.0.12, 3.0.9, 2.1.7, 1.1.21 |
| CVE-2026-102414 | MEDIUM | pbkdf2 | 3.1.3 | 3.1.7 |
| CVE-2026-104844 | MEDIUM | postcss-selector-parser | 6.1.4 | 7.1.6, 6.1.5 |
| CVE-2026-104844 | MEDIUM | postcss-selector-parser | 7.1.4 | 7.1.6, 6.1.5 |
| CVE-2026-109924 | MEDIUM | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109932 | MEDIUM | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-110180 | MEDIUM | fast-uri | 3.1.7 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-110306 | MEDIUM | fast-uri | 3.1.7 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-110816 | MEDIUM | qs | 6.13.0 | 6.16.1 |
| CVE-2026-110816 | MEDIUM | qs | 6.13.0 | 6.16.1 |
| CVE-2026-110816 | MEDIUM | qs | 6.15.3 | 6.16.1 |
| CVE-2026-110816 | MEDIUM | qs | 6.15.3 | 6.16.1 |
| CVE-2026-110816 | MEDIUM | qs | 6.16.0 | 6.16.1 |
| CVE-2026-110871 | MEDIUM | nodemailer | 8.0.3 | 10.0.10 |
| CVE-2026-110871 | MEDIUM | nodemailer | 9.1.1 | 10.0.10 |
| CVE-2026-111757 | MEDIUM | hono | 4.13.5 | 4.13.11 |
| CVE-2026-111997 | MEDIUM | ip-address | 10.4.0 | 10.7.4 |
| CVE-2026-111997 | MEDIUM | ip-address | 10.5.0 | 10.7.4 |
| CVE-2026-113654 | MEDIUM | sanitize-html | 2.17.7 | 2.18.0 |
| CVE-2026-113661 | MEDIUM | sanitize-html | 2.17.7 | 2.18.0 |
| CVE-2026-118764 | MEDIUM | minimatch | 10.2.5 | 11.0.1 |
| CVE-2026-118764 | MEDIUM | minimatch | 9.0.9 | 11.0.1 |
| CVE-2026-118764 | MEDIUM | minimatch | 9.0.9 | 11.0.1 |
| CVE-2026-118773 | MEDIUM | glob | 10.5.0 | 14.0.2 |
| CVE-2026-118773 | MEDIUM | glob | 10.5.0 | 14.0.2 |
| CVE-2026-118773 | MEDIUM | glob | 13.0.6 | 14.0.2 |
| CVE-2026-118777 | MEDIUM | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-118778 | MEDIUM | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-119186 | MEDIUM | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-17495 | MEDIUM | moment | 2.30.1 | 2.31.0 |
| CVE-2026-2739 | MEDIUM | bn.js | 4.12.0 | 4.12.3, 5.2.3 |
| CVE-2026-2739 | MEDIUM | bn.js | 5.2.1 | 4.12.3, 5.2.3 |
| CVE-2026-2739 | MEDIUM | bn.js | 5.2.1 | 4.12.3, 5.2.3 |
| CVE-2026-31808 | MEDIUM | file-type | 16.5.4 | 21.3.1 |
| CVE-2026-41305 | MEDIUM | postcss | 8.5.1 | 8.5.10 |
| CVE-2026-41650 | MEDIUM | fast-xml-parser | 5.5.11 | 5.7.0 |
| CVE-2026-41650 | MEDIUM | fast-xml-parser | 5.6.0 | 5.7.0 |
| CVE-2026-41907 | MEDIUM | uuid | 8.3.2 | 11.1.1, 12.0.1, 13.0.1 |
| CVE-2026-41907 | MEDIUM | uuid | 8.3.2 | 11.1.1, 12.0.1, 13.0.1 |
| CVE-2026-41907 | MEDIUM | uuid | 8.3.2 | 11.1.1, 12.0.1, 13.0.1 |
| CVE-2026-41907 | MEDIUM | uuid | 9.0.1 | 11.1.1, 12.0.1, 13.0.1 |
| CVE-2026-41907 | MEDIUM | uuid | 9.0.1 | 11.1.1, 12.0.1, 13.0.1 |
| CVE-2026-45819 | MEDIUM | baseline-browser-mapping | 2.10.40 | 2.11.0 |
| CVE-2026-45820 | MEDIUM | fflate | 0.8.2 | 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3 |
| CVE-2026-45822 | MEDIUM | decode-uri-component | 0.2.2 | 0.5.0 |
| CVE-2026-4738 | MEDIUM | zlib | 1.3.2-r1 | 1.4-r0 |
| CVE-2026-53655 | MEDIUM | tar | 6.2.1 | 7.5.16 |
| CVE-2026-53655 | MEDIUM | tar | 6.2.1 | 7.5.16 |
| CVE-2026-59871 | MEDIUM | tar | 6.2.1 | 7.5.18 |
| CVE-2026-59871 | MEDIUM | tar | 6.2.1 | 7.5.18 |
| CVE-2026-59875 | MEDIUM | tar | 6.2.1 | 7.5.17 |
| CVE-2026-59875 | MEDIUM | tar | 6.2.1 | 7.5.17 |
| CVE-2026-69153 | MEDIUM | postcss | 8.5.1 | 8.5.23 |
| CVE-2026-82417 | MEDIUM | qs | 6.13.0 | 6.16.0 |
| CVE-2026-82417 | MEDIUM | qs | 6.13.0 | 6.16.0 |
| CVE-2026-82417 | MEDIUM | qs | 6.15.3 | 6.16.0 |
| CVE-2026-82417 | MEDIUM | qs | 6.15.3 | 6.16.0 |
| CVE-2026-82562 | MEDIUM | qs | 6.15.3 | 6.16.0 |
| CVE-2026-82562 | MEDIUM | qs | 6.15.3 | 6.16.0 |
| CVE-2026-84369 | MEDIUM | svgo | 2.8.2 | 2.8.4, 3.3.5, 4.1.0 |
| CVE-2026-85024 | MEDIUM | undici | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| CVE-2026-85062 | MEDIUM | colord | 2.9.3 | 2.9.4 |
| CVE-2026-85063 | MEDIUM | csv-parse | 5.5.6 | 7.0.2 |
| CVE-2026-86472 | MEDIUM | fast-uri | 3.1.7 | 2.4.7, 3.1.8, 4.1.5 |
| CVE-2026-8723 | MEDIUM | qs | 6.13.0 | 6.15.2 |
| CVE-2026-8723 | MEDIUM | qs | 6.13.0 | 6.15.2 |
| CVE-2026-93981 | MEDIUM | hono | 4.13.5 | 4.13.7 |
| GHSA-268h-hp4c-crq3 | MEDIUM | nodemailer | 8.0.3 | 8.0.9 |
| GHSA-4ffr-jq9g-5ffx | MEDIUM | nodemailer | 8.0.3 | 10.0.13 |
| GHSA-4ffr-jq9g-5ffx | MEDIUM | nodemailer | 9.1.1 | 10.0.13 |
| GHSA-4g23-2xm8-66gc | MEDIUM | nodemailer | 8.0.3 | 10.0.10 |
| GHSA-4g23-2xm8-66gc | MEDIUM | nodemailer | 9.1.1 | 10.0.10 |
| GHSA-6vj9-mwq6-2f5v | MEDIUM | nodemailer | 8.0.3 | 10.0.2 |
| GHSA-6vj9-mwq6-2f5v | MEDIUM | nodemailer | 9.1.1 | 10.0.2 |
| GHSA-85x2-q946-cp5h | MEDIUM | nodemailer | 8.0.3 | 10.1.4 |
| GHSA-85x2-q946-cp5h | MEDIUM | nodemailer | 9.1.1 | 10.1.4 |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM | nodemailer | 8.0.3 | 10.1.4 |
| GHSA-8c8m-p3m8-cjg8 | MEDIUM | nodemailer | 9.1.1 | 10.1.4 |
| GHSA-8m3c-c648-2xjj | MEDIUM | nodemailer | 8.0.3 | 9.1.1 |
| GHSA-8vvx-rff5-p5rq | MEDIUM | nodemailer | 8.0.3 | 10.0.2 |
| GHSA-8vvx-rff5-p5rq | MEDIUM | nodemailer | 9.1.1 | 10.0.2 |
| GHSA-cc9r-2j5m-2m83 | MEDIUM | nodemailer | 8.0.3 | 9.1.0 |
| GHSA-g57g-f23g-4646 | MEDIUM | nodemailer | 9.1.1 | 10.0.9 |
| GHSA-g73g-hqqh-jr95 | MEDIUM | nodemailer | 8.0.3 | 10.0.13 |
| GHSA-g73g-hqqh-jr95 | MEDIUM | nodemailer | 9.1.1 | 10.0.13 |
| GHSA-m943-m63m-w62w | MEDIUM | nodemailer | 8.0.3 | 10.1.4 |
| GHSA-m943-m63m-w62w | MEDIUM | nodemailer | 9.1.1 | 10.1.4 |
| GHSA-vvjj-xcjg-gr5g | MEDIUM | nodemailer | 8.0.3 | 8.0.5 |
| GHSA-wmmp-3585-3rmp | MEDIUM | nodemailer | 8.0.3 | 9.1.0 |
| GHSA-wqvq-jvpq-h66f | MEDIUM | nodemailer | 8.0.3 | 8.0.9 |
| CVE-2024-47764 | LOW | cookie | 0.4.1 | 0.7.0 |
| CVE-2025-14505 | LOW | elliptic | 6.6.1 | |
| CVE-2025-54798 | LOW | tmp | 0.2.3 | 0.2.4 |
| CVE-2025-7339 | LOW | on-headers | 1.0.2 | 1.1.0 |
| CVE-2026-101915 | LOW | @grpc/grpc-js | 1.14.4 | 1.13.6, 1.14.5 |
| CVE-2026-103923 | LOW | katex | 0.16.47 | 0.18.2 |
| CVE-2026-110095 | LOW | fast-uri | 3.1.7 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-110725 | LOW | fast-uri | 3.1.7 | 2.4.8, 3.1.9, 4.2.3 |
| CVE-2026-113657 | LOW | sanitize-html | 2.17.7 | 2.18.0 |
| CVE-2026-115730 | LOW | i18next-http-backend | 4.0.2 | 4.0.3 |
| CVE-2026-118258 | LOW | i18next-http-backend | 4.0.2 | 4.0.4 |
| CVE-2026-118775 | LOW | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-118780 | LOW | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-118781 | LOW | node-forge | 1.4.0 | 1.4.1 |
| CVE-2026-12590 | LOW | body-parser | 1.20.3 | 1.20.6, 2.3.0 |
| CVE-2026-18540 | LOW | undici | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| CVE-2026-2391 | LOW | qs | 6.13.0 | 6.14.2 |
| CVE-2026-2391 | LOW | qs | 6.13.0 | 6.14.2 |
| GHSA-6688-9rhm-gjv2 | LOW | dompurify | 3.4.14 | 3.4.16 |
| GHSA-c6gr-qvv4-5v3f | LOW | dompurify | 3.4.14 | 3.4.17 |
| GHSA-c7w3-x93f-qmm8 | LOW | nodemailer | 8.0.3 | 8.0.4 |
| GHSA-p98j-92pf-mc4p | LOW | dompurify | 3.4.14 | 3.4.16 |