Security: Remediate 3,147 vulnerabilities across 26 container images (Hub + Verifier)

[ajile-in]

Summary

3,147 vulnerability findings across 26 container images in CREDEBL Hub and Verifier deployments. 97% have fixes available.

Report	Findings	Unique CVEs	Images	Packages	Fixes Available
Hub	2,255	325	20	76	2,204 (98%)
Verifier	892	404	6	70	838 (94%)
Total	3,147	—	26	—	3,042 (97%)

Related: #1728 (platform npm vulns — PR #1729 in progress)

---

Severity Breakdown

Severity	Hub	Verifier	Total
CRITICAL	155	68	223
HIGH	1,059	366	1,425
MEDIUM	858	398	1,256
LOW	183	46	229

---

Hub Images (20)

NestJS Services (16) — identical vuln profile

All 16 v2.2.0 services share the same Alpine 3.23 base and dependency set. One fix applies to all 16.

Image	Findings	Critical	High	Packages
Each NestJS service (x16)	114	7	53	43

Other Hub Images

Image	Platform	Findings	Critical	High	Packages
seed-v2.1.4-alpha.11	ALPINE_3.21	239	17	132	69
nats-2.12.4-alpine	ALPINE_3.22	76	10	36	7
nats-2.12.3	SCRATCH	53	8	22	4
nats-2.12.4	SCRATCH	50	8	21	4

---

Verifier Images (6)

Image	Platform	Findings	Critical	High	Packages
credo-controller-v2.2.0	DEBIAN_12	318	28	160	52
verifier-service-20	ALPINE_3.22	182	12	66	18
trust-service-2	ALPINE_3.22	158	9	54	18
consent-management-2	ALPINE_3.22	40	3	18	4

---

Remediation Plan

P0 — Base Image Rebuilds (~600+ findings, lowest effort)

Rebuild all images on updated base images. Fixes OS-level and Go stdlib vulns.

Package	Current	Target	Findings	Risk
go/stdlib (Verifier)	1.16.2, 1.20.7, 1.23.12	1.26.5 toolchain	~253	Low
go/stdlib (Hub NATS)	1.25.5, 1.25.6	1.26.5	~72	Low
openssl	3.5.4, 3.5.5	3.5.7 LTS	~170	Low
openssl/openssl	3.0.16, 3.3.6, 3.5.5	3.5.7 LTS	~22	Low
musl	1.2.5	1.2.6	varies	Low
zlib	1.3.1	1.3.2	varies	Low
xz-utils	5.4.1, 5.8.1	5.8.3	varies	Low
perl	5.36.0, 5.40.1	5.42.2	varies	Low
glibc	2.41	2.44	varies	Low

P1 — Shared Node.js Bumps (all 16 Hub services + Verifier)

These apply to ALL NestJS images. Fix once, rebuild all.

Package	Current	Target	Effort	Risk
axios	1.13.x, 1.16.0	1.19.0	minor	Low
handlebars	4.7.8	4.7.9	patch	Low
lodash	4.17.21	4.18.1	minor	Low
form-data	4.0.4, 4.0.5	4.0.6	patch	Low
websocket-driver	0.7.4	0.7.5	patch	Low
ws	8.17-8.19	8.21.2	minor	Low
qs	6.14.0	6.15.3	minor	Low
@grpc/grpc-js	1.14.2	1.14.4	patch	Low
tar-fs	3.x	latest 3.x	minor	Low
brace-expansion	2.0.2	2.1.4	override	Low
fast-uri	3.1.0	3.1.6	patch	Low
ip-address	10.1.0	10.5.0	minor	Low
socket.io-parser	patch	latest	patch	Low
cross-spawn	patch	latest	patch	Low
engine.io	patch	latest	patch	Low
follow-redirects	1.15.11	1.16.0	minor	Low
@opentelemetry/propagator-jaeger	2.0.1	2.10.0	minor	Low
@protobufjs/utf8	1.1.0	1.1.2	patch	Low
validator	patch	latest	patch	Low
@nestjs/microservices	patch	latest	patch	Low

P2 — Go Module Bumps (cred-controller + NATS)

Package	Current	Target	Effort	Risk
golang.org/x/crypto	v0.46/v0.0.0	v0.54.0	go get	High
golang.org/x/net	v0.0.0-2020	v0.55.0	go get	High
golang.org/x/text	v0.3.3	v0.31.0	go get	High
golang.org/x/sys	varies	v0.47.0	go get	High
google.golang.org/grpc	v1.29.1	v1.81.1	go get	Low
github.com/gogo/protobuf	v1.3.1	v1.3.2	patch	Low

P3 — High-Effort Major Bumps (schedule separately)

Package	Current	Target	Notes
Node.js	22.22.2	26.x	Runtime major bump
pnpm	9.15.3	11.20.0	Package manager major
protobufjs	7.5.4	8.7.1	Changes codegen
fast-xml-parser	4.5.3	5.10.1	Major
basic-ftp	5.0.5	6.2.0	Major
tough-cookie	2.5.0	6.0.2	Major
multer	old	2.x	Major
nodemailer	7.0.10	9.0.3	Major
@opentelemetry/exporter-prometheus	0.202.0	0.221.0	Major
ajv	6.12.6	8.20.0	Major
glob	old	9.x	ESM-only

P4 — Accepted Risk / Deferred

Package	Reason
request	Deprecated, no fix available
@babel/core	Dev-only (jest)
aws-sdk v2	Separate migration effort
fs (npm)	Security placeholder, not real dep
OS packages (busybox, systemd, etc.)	Handled in P0 base image rebuild

---

Execution Order

1. P0 — Rebuild base images (biggest impact, lowest risk, all images)
2. P1 — Node.js minor/patch bumps (apply to all 16 Hub services, test once, rebuild all)
3. P2 — Go module bumps (cred-controller + NATS, coordinate with Go team)
4. P3 — Major bumps (schedule per-service, one at a time)
5. Re-scan after each phase

---

Success Criteria

• 0 CRITICAL findings after P0 + P1
• HIGH findings reduced by >80% after P2
• All remaining MEDIUM/LOW documented with accepted-risk justification
• Re-scan report shows green for all Hub services and Verifier images

[ajile-in]

P0+P1 progress — PR #1729

P0: Base image rebuild (Hub images)

• Updated all 19 Dockerfiles: node:24-alpine3.23 → node:24-alpine3.24
• Alpine 3.24 ships newer OpenSSL, musl, zlib, perl
• apk upgrade already runs in all Dockerfiles (pulls latest patches)
• CI verified ✅

P1: Package manager bump

• pnpm 9.15.3 → 9.15.9 (latest 9.x patch, security fixes)
• Updated packageManager field in package.json to match
• CI verified ✅

Note: Verifier images (credo-controller, verifier-service, trust-service, airport-service, consent-management) are in a separate repo — require coordinated Go/Debian base image rebuilds.

Next: PR #1729 is now at 8 commits, all CI green. Ready for review/merge.

---

What's left after PR #1729 merges

Package	Current	Target	Repo	Effort
Go stdlib	1.16–1.23	1.26.5	Verifier	Medium
OpenSSL (Verifier)	3.0.16–3.3.6	3.5.7	Verifier base	Low
glibc	2.41	2.44	Verifier base	Low
Node.js runtime	22.x	26.x	Hub Dockerfiles	High
aws-sdk	2.x	3.x	Platform	High