kapsl Index
Docs Releases

nodejs

1 tool · 4 release lines

Node.js runtime. Every tool here carries the same sandbox boundary.

kapsl node
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description
showing node from nodejs@latest → 26.8.1 stable nodejs@26 → 26.8.1 stable nodejs@24 → 24.20.0 stable nodejs@22 → 22.23.2 stable

Findings

C1H2M3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-33630 ↗ H 7.5 c-ares c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling.
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-69184 ↗ M — c-ares CVE-2026-69184
CVE-2026-69186 ↗ M — c-ares CVE-2026-69186

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of nodejs, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H2M3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-33630 ↗ H 7.5 c-ares c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling.
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-69184 ↗ M — c-ares CVE-2026-69184
CVE-2026-69186 ↗ M — c-ares CVE-2026-69186

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of nodejs, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H2M3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-33630 ↗ H 7.5 c-ares c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling.
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-69184 ↗ M — c-ares CVE-2026-69184
CVE-2026-69186 ↗ M — c-ares CVE-2026-69186

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of nodejs, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C1H2M3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-75803 ↗ C 9.1 openssl Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-33630 ↗ H 7.5 c-ares c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling.
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-69184 ↗ M — c-ares CVE-2026-69184
CVE-2026-69186 ↗ M — c-ares CVE-2026-69186

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed
CVE-2026-27171 zlib not affected · vex

These are the findings of nodejs, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default + bash, env
runtime none — self-contained
composes bash, env

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

name nodejs
platforms
size 134 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name nodejs
platforms
size 134 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name nodejs
platforms
size 122 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name nodejs
platforms
size 126 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Sandbox boundary

node

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.node_repl_history · writable

env passed through

3 forwarded

NODE_DEBUGNODE_NO_WARNINGSNODE_OPTIONS

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

4 set

CPLUS_INCLUDE_PATHC_INCLUDE_PATHLIBRARY_PATHPKG_CONFIG_PATH

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

6 findings across this project at latest. Counted once per advisory across every image the project builds.