From 018566b3e17395bb19fa0fa6c67400b0939e484a Mon Sep 17 00:00:00 2001 From: briquet Date: Fri, 23 Oct 2026 21:07:33 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(frontend)=20upgrade=20ngi?= =?UTF-8?q?nx=20to=201.30.6=20to=20fix=20CVE-2026-15176?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump the nginx-unprivileged base image to 1.30.6-alpine3.24, which fixes a heap overflow when using alias with rewrite, along with CVE-2026-93479, CVE-2026-95101 and CVE-2026-97629. https://nginx.org/en/security_advisories.html --- CHANGELOG.md | 1 + docker/dinum-frontend/Dockerfile | 2 +- src/frontend/Dockerfile | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3270fbd4f..6f7d0ef55 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to ### Fixed - 🔒️(backend) upgrade brotli to 1.2.1 to fix CVE-2026-111497 +- 🔒️(frontend) upgrade nginx to 1.30.6 to fix CVE-2026-15176 - 🔒️(docker) upgrade brotli-libs to 1.2.1 to fix CVE-2026-111497 - 🔒️(frontend) build the Outlook add-in on Node 22.23.4 diff --git a/docker/dinum-frontend/Dockerfile b/docker/dinum-frontend/Dockerfile index b5c27e3a6..d2e8dd385 100644 --- a/docker/dinum-frontend/Dockerfile +++ b/docker/dinum-frontend/Dockerfile @@ -58,7 +58,7 @@ RUN npx webpack --mode production # ---- Front-end image ---- -FROM nginxinc/nginx-unprivileged:1.30.5-alpine3.24 AS frontend-production +FROM nginxinc/nginx-unprivileged:1.30.6-alpine3.24 AS frontend-production USER root RUN apk upgrade --no-cache libexpat && \ diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile index d49cf9842..cb5175cff 100644 --- a/src/frontend/Dockerfile +++ b/src/frontend/Dockerfile @@ -47,7 +47,7 @@ ENV VITE_MEDIA_BASE_URL=${VITE_MEDIA_BASE_URL} RUN npm run build # ---- Front-end image ---- -FROM nginxinc/nginx-unprivileged:1.30.5-alpine3.24 AS frontend-production +FROM nginxinc/nginx-unprivileged:1.30.6-alpine3.24 AS frontend-production USER root RUN apk upgrade --no-cache libexpat && \