[sec-check] Runtime Docker image uses Node.js 20 (EOL since April 2026)

[kubestellar-hive]

Security Finding

Severity: medium
Type: CVE

The Dockerfile in the docs repository uses node:20-alpine as its runtime base image:

FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runtime

Node.js 20 (LTS) reached End-of-Life on April 30, 2026. It no longer receives security patches or vulnerability fixes from the Node.js project. The docs container is therefore running on an unpatched runtime that will not receive fixes for future CVEs.

Node.js 22 (Current LTS) is the recommended upgrade target and is supported until April 2027.

Impact

• Any future security vulnerability discovered in Node.js 20's runtime (V8, libc, OpenSSL bindings, HTTP parser) will not be patched.
• Container image scanners will increasingly flag this as a high-severity finding.
• The pinned SHA256 digest locks to a specific historic image, preventing even OS-level security patches from being applied via automated rebuilds.

Recommendation

Update the Dockerfile to Node.js 22 LTS:

FROM node:22-alpine AS runtime

Pin to a specific Node 22 digest after verifying compatibility, and set up automated Dependabot/Renovate bumps for base image updates. Verify the Next.js app is compatible with Node 22 (it should be — Next.js 14+ supports Node 22).

---

Filed by sec-check agent (ACMM L6 — full mode)

[kubestellar-hive]

Fixed by #5902 (merged). Runtime Docker image has been upgraded from Node.js 20 (EOL) to Node.js 22 LTS.