Security: Remediate 3,147 vulnerabilities across 26 container images (Hub + Verifier)

[ajile-in]

Tracking issue — Container Image Vulnerability Remediation (Q3 2026)

3,147 vulnerability findings across 26 container images in CREDEBL Hub and Verifier deployments. 97% have fixes available.

This is the parent tracking issue. Work is split into 9 assignable sub-issues by Deployment (Hub/Verifier) and Severity (CRIT/HIGH/MED/LOW), plus one transversal Accepted-Risk issue.

Report (original): [Aug 26 2026 scan report]
Related: #1728 (platform npm vulns — PR #1729 merged Sep 7)

---

Progress matrix

Sub-issue	Deployment	Severity	Findings	Upstream / Owned (approx)	Status	Progress	Owner	Re-scan result
#1750	Hub	CRITICAL	155	~95% / ~5%	🟡 Open	33%	—	—
#1751	Hub	HIGH	1,059	~85% / ~15%	🟡 Open	50%	—	—
#1752	Hub	MEDIUM	858	~70% / ~30%	🟡 Open	0%	—	—
#1753	Hub	LOW	183	~50% / ~50%	🟡 Open	0%	—	—
#1754	Verifier	CRITICAL	68	~90% / ~10%	🟡 Open	0%	—	—
#1755	Verifier	HIGH	366	~85% / ~15%	🟡 Open	0%	—	—
#1756	Verifier	MEDIUM	398	~70% / ~30%	🟡 Open	0%	—	—
#1757	Verifier	LOW	46	~50% / ~50%	🟡 Open	0%	—	—
#1758	All	Accepted Risk	—	—	🟢 Documented	100%	—	—
Total			3,147		0/8 closed	46% overall

Update the Status / Progress / Re-scan columns above whenever a sub-issue is updated or re-scanned.
Progress % is test-based (unlike the earlier estimate): computed by pnpm security:progress (npm version gates + behavioral spec presence from security/verification-targets.json). Container/OS/Go targets are verifiable only by image re-scan and count 0% until then. Regression proof: 18 CI suites / 211 tests passing (pnpm jest --config jest.ci.config.js --runInBand). Gate enforcement opt-in: RUN_SECURITY_GATES=true pnpm test:security:gates.

---

Execution order

1. P0 — Rebuild base images (biggest impact, lowest risk) → Hub Security (Hub): remediate CRITICAL container image vulnerabilities #1750-1753; Verifier Security (Verifier): remediate CRITICAL container image vulnerabilities #1754-1757
2. P1 — Shared Node.js bumps (apply to all 16 Hub NestJS + Verifier services) → CRITICAL + HIGH issues
3. P2 — Go module bumps (cred-controller + NATS) → CRITICAL + HIGH issues
4. P3 — Major bumps (schedule per-service) → MEDIUM + LOW issues
5. Re-scan after each phase; update this matrix

Success criteria

• 0 CRITICAL findings across Hub + Verifier after P0 + P1
• HIGH findings reduced by >80% after P2
• All remaining MEDIUM/LOW documented in #1758 with accepted-risk justification
• All 8 severity sub-issues closed; #1758 reflects final accepted-risk state

---

Hub images (20 images)

NestJS services (16) — identical vuln profile

All 16 v2.2.0 services share Alpine 3.23 base and same dependency set. One fix applies to all 16.

Image	Findings	Critical	High	Packages
Each NestJS service (×16)	114	7	53	43

Other Hub images

Image	Platform	Findings	Critical	High	Packages
seed-v2.1.4-alpha.11	Alpine 3.21	239	17	132	69
nats-2.12.4-alpine	Alpine 3.22	76	10	36	7
nats-2.12.3	Scratch	53	8	22	4
nats-2.12.4	Scratch	50	8	21	4

Verifier images (6 images)

Image	Platform	Findings	Critical	High	Packages
credo-controller-v2.2.0	Debian 12	318	28	160	52
verifier-service-20	Alpine 3.22	182	12	66	18
trust-service-2	Alpine 3.22	158	9	54	18
consent-management-2	Alpine 3.22	40	3	18	4
(2 unmapped images)	—	194	16	68	—

Note: Verifier images are built in the external Verifier repo; work tracked here, PRs open there.

---

Severity breakdown (original)

Severity	Hub	Verifier	Total
CRITICAL	155	68	223
HIGH	1,059	366	1,425
MEDIUM	858	398	1,256
LOW	183	46	229

---

Remediation plan (P0–P4)

P0 — Base image rebuilds (~600+ findings, lowest effort)

Package	Current	Target	Findings	Risk
go/stdlib (Verifier)	1.16.2, 1.20.7, 1.23.12	1.26.5 toolchain	~253	Low
go/stdlib (Hub NATS)	1.25.5, 1.25.6	1.26.5	~72	Low
openssl	3.5.4, 3.5.5	3.5.7 LTS	~170	Low
openssl/openssl	3.0.16, 3.3.6, 3.5.5	3.5.7 LTS	~22	Low
musl	1.2.5	1.2.6	varies	Low
zlib	1.3.1	1.3.2	varies	Low
xz-utils	5.4.1, 5.8.1	5.8.3	varies	Low
perl	5.36.0, 5.40.1	5.42.2	varies	Low
glibc	2.41	2.44	varies	Low

P1 — Shared Node.js bumps (all 16 Hub services + Verifier)

Package	Current	Target	Effort	Risk
axios	1.13.x, 1.16.0	1.19.0	minor	Low
handlebars	4.7.8	4.7.9	patch	Low
lodash	4.17.21	4.18.1	minor	Low
form-data	4.0.4, 4.0.5	4.0.6	patch	Low
websocket-driver	0.7.4	0.7.5	patch	Low
ws	8.17-8.19	8.21.2	minor	Low
qs	6.14.0	6.15.3	minor	Low
@grpc/grpc-js	1.14.2	1.14.4	patch	Low
tar-fs	3.x	latest 3.x	minor	Low
brace-expansion	2.0.2	2.1.4	override	Low
fast-uri	3.1.0	3.1.6	patch	Low
ip-address	10.1.0	10.5.0	minor	Low
socket.io-parser	—	latest	patch	Low
cross-spawn	—	latest	patch	Low
engine.io	—	latest	patch	Low
follow-redirects	1.15.11	1.16.0	minor	Low
@opentelemetry/propagator-jaeger	2.0.1	2.10.0	minor	Low
@protobufjs/utf8	1.1.0	1.1.2	patch	Low
validator	—	latest	patch	Low
@nestjs/microservices	—	latest	patch	Low

P2 — Go module bumps (cred-controller + NATS)

Package	Current	Target	Effort	Risk
golang.org/x/crypto	v0.46/v0.0.0	v0.54.0	go get	High
golang.org/x/net	v0.0.0-2020	v0.55.0	go get	High
golang.org/x/text	v0.3.3	v0.31.0	go get	High
golang.org/x/sys	varies	v0.47.0	go get	High
google.golang.org/grpc	v1.29.1	v1.81.1	go get	Low
github.com/gogo/protobuf	v1.3.1	v1.3.2	patch	Low

P3 — High-effort major bumps (schedule separately)

Package	Current	Target	Notes
Node.js	22.22.2	26.x	Runtime major bump
pnpm	9.15.3	11.20.0	Package manager major
protobufjs	7.5.4	8.7.1	Changes codegen
fast-xml-parser	4.5.3	5.10.1	Major
basic-ftp	5.0.5	6.2.0	Major
tough-cookie	2.5.0	6.0.2	Major
multer	old	2.x	Major
nodemailer	7.0.10	9.0.3	Major
@opentelemetry/exporter-prometheus	0.202.0	0.221.0	Major
ajv	6.12.6	8.20.0	Major
glob	old	9.x	ESM-only

P4 — Accepted risk / deferred → #1758

Package	Reason
request	Deprecated, no fix available
@babel/core	Dev-only (jest)
aws-sdk v2	Separate migration effort
fs (npm)	Security placeholder, not real dep
OS packages (busybox, systemd, etc.)	Handled in P0 base image rebuild

[ajile-in]

P0+P1 progress — PR #1729

P0: Base image rebuild (Hub images)

• Updated all 19 Dockerfiles: node:24-alpine3.23 → node:24-alpine3.24
• Alpine 3.24 ships newer OpenSSL, musl, zlib, perl
• apk upgrade already runs in all Dockerfiles (pulls latest patches)
• CI verified ✅

P1: Package manager bump

• pnpm 9.15.3 → 9.15.9 (latest 9.x patch, security fixes)
• Updated packageManager field in package.json to match
• CI verified ✅

Note: Verifier images (credo-controller, verifier-service, trust-service, airport-service, consent-management) are in a separate repo — require coordinated Go/Debian base image rebuilds.

Next: PR #1729 is now at 8 commits, all CI green. Ready for review/merge.

---

What's left after PR #1729 merges

Package	Current	Target	Repo	Effort
Go stdlib	1.16–1.23	1.26.5	Verifier	Medium
OpenSSL (Verifier)	3.0.16–3.3.6	3.5.7	Verifier base	Low
glibc	2.41	2.44	Verifier base	Low
Node.js runtime	22.x	26.x	Hub Dockerfiles	High
aws-sdk	2.x	3.x	Platform	High

[Sufiyan-MSA]

Hey, can u pls assign me.

[ankita-p17]

Hey, can u pls assign me.

Hi @Sufiyan-MSA ,
We have divided this issue in small workable issues to be picked up.