Hestia is pre-1.0 — only the latest release gets security fixes.

Use GitHub Private Security Advisories, or open a GitHub Issue for non-sensitive reports.

Please include a description, reproduction steps, impact assessment, and a non-destructive proof of concept where possible. We'll acknowledge reports within a few days — this is a solo-maintained project, not a company with an SLA.

Last reviewed: 2026-08-17

Every entry below is suppressed in CI via .trivyignore and .grype.yaml, both scanned on every build (see .github/workflows/docker-build.yml). Suppressions carry an expiry date; when one is reached, it's re-checked against upstream rather than silently extended forever.

The base image was node:24.19.0-slim (Debian 12/bookworm) through 2026-08-09. A side-by-side full-severity scan of alternatives that day showed:

Switched to node:24.19.0-alpine. That alone dropped the Debian-specific findings this file used to document individually (util-linux family CVE-2026-53615, ncurses CVE-2025-69720, gzip CVE-2026-41992, libacl1 CVE-2026-54369, perl-base's 8 CVEs, zlib1g CVE-2023-45853 — none of them apply on Alpine's package set). Separately, stripping the bundled npm CLI from the runtime stage (never invoked there — CMD is node server.js) eliminated the 7 CVEs in npm's own bundled tar/brace-expansion/ip-address/undici, confirmed gone by rebuilding and re-scanning rather than assumed.

Net result verified by rescanning the built image with both scanners: 152 Trivy findings → 0. Remaining findings (both tools): 3 → 1 unique CVE, see below.

BusyBox wget accepts raw CR/LF and other control bytes in the HTTP request-target, allowing request-line splitting and attacker-controlled header injection. No fix version published as of 2026-08-09.

Why it's low-risk here: Hestia never invokes wget or any other busybox applet — the container's only process is node server.js (see Dockerfile CMD).

golang.org/x/crypto/openpgp is unmaintained and unsafe by design; upstream's advisory recommends github.com/ProtonMail/go-crypto/openpgp for anyone who needs OpenPGP interoperability. There is no fixed version — the advisory's point is "stop calling this subpackage," not "upgrade past it," so bumping x/crypto can never clear this finding.

Why it's not applicable here: Hestia has no PGP/OpenPGP feature and never imports openpgp. Both scanners flag it as a whole-module match, not a reachability finding — Grype's own matchDetails show go-module-matcher / versionConstraint: none (unknown), meaning any project depending on golang.org/x/crypto for anything (here, bcrypt for password hashing and transitively via golang-jwt/jwt) gets flagged regardless of which subpackage it actually calls. Verified two ways: go mod why golang.org/x/crypto/openpgp reports "main module does not need package golang.org/x/crypto/openpgp", and go list -deps ./... shows only bcrypt, chacha20poly1305, sha3, and their internal helpers pulled in — openpgp doesn't appear.

When a suppression's expiry date arrives:

1. Re-run the CVE/package through Trivy and Grype against the current base image.
2. Check whether Debian bookworm (for OS packages) or the relevant npm package (for the bundled tooling group) has shipped a fix.
3. If fixed: rebuild, confirm the finding is gone, remove the entry from .trivyignore, .grype.yaml, and this file in the same commit.
4. If not fixed: extend the expiry date, note the extension inline (matching the existing # exp: / expiry: comment style), and update "Last reviewed" above.