[knittingcode]

Summary

Documents the three HIGH undici findings that the container scan reports for the report-only web-dev image (CVE-2026-109869, CVE-2026-109383, CVE-2026-87018) in docs/security/container-vulnerabilities.md. Documentation only; no image, dependency, scanner or exception change. Despite the fix/ branch name, the branch changes only this document.

Motivation

The Trivy step of main 1badf76 (run 40745073009, push, success) reports, for the development web image only (3 HIGH/CRITICAL findings in web-dev, 0 suppressed by an exception):

HIGH CVE-2026-109383 undici 6.29.0 fixed=6.29.1, 7.30.1, 8.12.2 in=Node.js
HIGH CVE-2026-109869 undici 6.29.0 fixed=6.29.1, 7.30.1, 8.12.2 in=Node.js
HIGH CVE-2026-87018 undici 6.29.0 fixed=6.29.1, 7.30.1, 8.12.2 in=Node.js

The same run reports 0 HIGH/CRITICAL for api-prod, edge-prod (1 suppressed: the ADR-021 go-jose exception) and db. CVE-2026-109869 was first reported by main run 40101147084; the other two advisories were published on 2026-10-27, and 40745073009 is the first scan of main after that (the run before it, 40669720894 on 999d4d1, failed at BE-03 and skipped the scan).

Vulnerability evidence (GitHub advisory API, 2026-10-28; none withdrawn)

CVE	GHSA	CVSS 3.1	Affected	Issue
CVE-2026-109869	GHSA-xjj6-f33q-929c (2026-10-23)	7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	>=6.23.0 <6.29.1, >=7.18.0 <7.30.1, >=8.0.0 <8.12.2	fetch() crash on more than five content codings
CVE-2026-109383	GHSA-2m5v-pch6-74hx (2026-10-27)	7.4 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	>=4.0.0 <6.29.1, >=7.0.0 <7.30.1, >=8.0.0 <8.12.2	Agent drops a function-valued tls option (custom checkServerIdentity)
CVE-2026-87018	GHSA-qrxm-fqhp-jwvm (2026-10-27)	7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	>=4.2.1 <6.29.1, >=7.0.0 <7.30.1, >=8.0.0 <8.12.2	client crash on a TLS 1.2 renegotiation with a certificate for another host

Where the vulnerable undici comes from: it is the copy that the npm CLI bundles, /usr/local/lib/node_modules/npm/node_modules/undici. docker/web/Dockerfile replaces the npm of the Node image with npm 11.21.1 (NPM_VERSION, checksum-pinned), and the npm 11.21.1 registry tarball contains package/node_modules/undici 6.29.0 (verified 2026-10-28; tarball SHA-256 equals the pinned NPM_SHA256). It is not a project dependency. The other copies are fixed: Node.js 24.22.1 core undici 7.30.1 (deps/undici/src/package.json at tag v24.22.1, also 7.30.1 in v24.22.2) and the project's undici 8.12.3 via jsdom 30.1.3 (frontend/package-lock.json). The edge spa-build stage uses the npm 11.19.1 of Node 24.22.1 (undici 6.28.0); that stage is discarded and not in any image.

Impact and reachability

• Inside npm only the bundled node-gyp (lib/download.js) imports undici (a search of the 11.21.1 tarball for require('undici')/from 'undici' finds no other importer). The Dockerfiles install with npm ci --ignore-scripts; even without the flag node-gyp would not run (the only frontend package with an install script is fsevents, macOS only). npm audit and npm run load npm but not its undici; Vite, Vitest, tsc and ESLint do not load npm's modules.
• Even when node-gyp runs, createDispatcher passes only a CA (connect, requestTls, proxyTls), no function-valued tls option, so CVE-2026-109383 does not apply; the two DoS findings would only end a header download from a malicious server.
• Production-like images are unaffected (edge prod is the Caddy base plus the built SPA; api and db contain no Node.js).

Implementation

docs/security/container-vulnerabilities.md:

• The undici section, now "CVE-2026-109869, CVE-2026-109383, CVE-2026-87018: undici bundled with npm (web, development only)", covers all three advisories in one table (GHSA, CVSS, ranges, issue, first main scan), the copies table, where the open copy comes from, reachability, remediation status and the re-evaluation trigger. It stays between the brotli and curl sections, before the go-jose section of fix(security): remediate dependency advisories and guard Caddy exposure (ADR-021) #42.
• It states why the findings are not in the Exceptions table that fix(security): remediate dependency advisories and guard Caddy exposure (ADR-021) #42 added: the web image is report-only and its scan does not read security/trivyignore.yaml. No entry was added to that file.
• The web triage section says npm 11.21.1 has three later HIGH findings in its bundled undici and links the section.
• Remediation status as of 2026-10-28: no npm release bundles a fixed undici (11.21.1 and 12.2.1, 2026-10-15, both 6.29.0; their node-gyp 12.4.0/13.0.0 require ^6.25.0); node-gyp 13.1.0 requires ^8.4.1. Newest Node.js: 24.22.2 (2026-10-27, npm 11.19.1) and 26.13.0 (2026-10-28, npm 11.20.0); none bundles a fixed npm.

Commits: 87c0082 / 02b8ecd merges of main (#39; #38, #42), 6a80916 fact re-check, 112fbcd docs(security): document the three undici findings of npm 11.21.1 in the web image.

Testing performed

• 02b8ecd chore(merge): bring main (#38, #42) into the branch: normal merge, docs/security/container-vulnerabilities.md auto-merged with no conflict; git diff --check clean.
• Locally on 112fbcd: guard-tracked-files.sh, guard-dockerfile-frontend.sh, guard-trivyignore.sh and guard-edge-config.sh all exit 0 (the trivyignore guard reads only the rows under ## Exceptions, which this PR does not change).
• Anchors: #web-node-24221-development-and-test-only and the new section anchor follow GitHub's heading slugs.
• CI on head 112fbcd (workflow CI, pull_request, merged into main 1badf76): run 40752277331, success; every step of Repository guard and Dev environment succeeded, none skipped. TOTAL lines: guard regression 36/36, Dockerfile frontend guard 73/73, scan exception guard 87/87, edge configuration guard 221/221; allocator unit 288/288, allocator integration 140/140 (24 scenarios); backend 18/18 (BE-18 53 of 53 negative controls detected); frontend 5/5; application stack 124/124; production-like stack 39/39; container scan 20/20. The scan reports 3 HIGH/CRITICAL findings in web-dev (CVE-2026-109383, CVE-2026-109869, CVE-2026-87018, undici 6.29.0), 0 for api-prod, edge-prod (1 suppressed, CVE-2026-116587), db and api-dev, and 1 for edge-dev (CVE-2026-116587), matching the document.

Security considerations

The three findings stay open in the development web image until npm ships a fixed undici; they are not reachable in the configured install path and not present in any runtime image. No exception is added, so nothing is suppressed. No secrets or local configuration are included.

Known limitations

• The web dev scan keeps reporting 3 HIGH findings until an npm release bundles undici >= 6.29.1 / 7.30.1 / 8.12.2 (re-evaluation trigger in the document).
• The edge spa-build stage (npm 11.19.1, undici 6.28.0) is not scanned, because it is not in any image.