diff --git a/docker/api/Dockerfile b/docker/api/Dockerfile
index ba72f9e..c729eb5 100644
--- a/docker/api/Dockerfile
+++ b/docker/api/Dockerfile
@@ -11,10 +11,11 @@ ARG COMPOSER_IMAGE=composer:2.9.7@sha256:02062f7719ec9433a9d4256cfba1c792db96dc9
 FROM ${COMPOSER_IMAGE} AS composer
 
 FROM ${PHP_IMAGE} AS base
-# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base
-# image still ships; remove once the base includes it
+# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and curl/libcurl
+# >= 8.23.0-r0 fix CVE-2026-92392 (HIGH), which the pinned base image still
+# ships; remove once the base includes them
 # (docs/security/container-vulnerabilities.md).
-RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' \
+RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0' \
     && apk add --no-cache fcgi postgresql-libs \
     && apk add --no-cache --virtual .build-deps $PHPIZE_DEPS postgresql-dev \
     && docker-php-ext-install -j"$(nproc)" pdo_pgsql \
diff --git a/docker/db/Dockerfile b/docker/db/Dockerfile
index becf190..fcfe378 100644
--- a/docker/db/Dockerfile
+++ b/docker/db/Dockerfile
@@ -8,9 +8,11 @@
 ARG POSTGRES_IMAGE=postgres:18.6-alpine3.24@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
 
 FROM ${POSTGRES_IMAGE}
-# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base
-# image still ships (docs/security/container-vulnerabilities.md).
-RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' \
+# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and libcurl
+# >= 8.23.0-r0 fixes CVE-2026-92392 (HIGH), which the pinned base image still
+# ships (docs/security/container-vulnerabilities.md). The base image has
+# libcurl but no curl tool, so only the library is upgraded.
+RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'libcurl>=8.23.0-r0' \
     && rm -f /usr/local/bin/gosu
 # Database roles (ADR-018): created on a new volume by the initdb hook, and
 # checked or upgraded by bin/devenv through flowcrm-db-roles.
diff --git a/docker/edge/Dockerfile b/docker/edge/Dockerfile
index 6cc6156..d421000 100644
--- a/docker/edge/Dockerfile
+++ b/docker/edge/Dockerfile
@@ -20,9 +20,10 @@ COPY docker/edge/caddy/main.go ./
 RUN go build -trimpath -ldflags "-s -w" -o /out/caddy . && /out/caddy version
 
 FROM ${CADDY_IMAGE} AS caddy-base
-# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base
-# image still ships (docs/security/container-vulnerabilities.md).
-RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0'
+# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and curl/libcurl
+# >= 8.23.0-r0 fix CVE-2026-92392 (HIGH), which the pinned base image still
+# ships (docs/security/container-vulnerabilities.md).
+RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0'
 # The rebuilt binary has no file capabilities: port 8080 needs none, and a
 # container without capabilities could not exec a binary that requests one.
 COPY --from=caddy-build /out/caddy /usr/bin/caddy
diff --git a/docs/security/container-vulnerabilities.md b/docs/security/container-vulnerabilities.md
index 57a411a..bf58b60 100644
--- a/docs/security/container-vulnerabilities.md
+++ b/docs/security/container-vulnerabilities.md
@@ -159,6 +159,32 @@ repositories. No base image ships it yet, so `docker/api/Dockerfile`,
 version cannot be installed). Remove the upgrade when the pinned base
 images include the fix. No exception was added.
 
+## CVE-2026-92392: `curl` and `libcurl` (runtime images)
+
+Published after the last green scan of `main` (run 40223497868,
+2026-10-25); found by the scan of PR #38 (run 40383573386, 2026-10-26), not
+by a change of the project. The Alpine packages `curl` and `libcurl`
+8.22.0-r0 (HIGH) come from the pinned base images:
+
+| Image | Base (Alpine) | Affected packages |
+|---|---|---|
+| api (`prod`, `dev`) | PHP 8.5.12 FPM (3.24.2) | `curl`, `libcurl` |
+| edge (`prod`, `dev`) | Caddy 2.11.7 (3.23.6) | `curl`, `libcurl` |
+| db | PostgreSQL 18.6 (3.24.2) | `libcurl` (no `curl` tool) |
+
+8.23.0-r0 fixes it and is in the Alpine 3.23 and 3.24 `main` repositories
+for x86_64 and aarch64 (built 2026-10-25). The current builds of the base
+image tags were created on 2026-10-21, before the fix, so refreshing the
+pinned digests would not help. `docker/api/Dockerfile` and
+`docker/edge/Dockerfile` upgrade both packages
+(`apk add --upgrade 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0'`),
+`docker/db/Dockerfile` upgrades `libcurl` only, so no package is added to an
+image; the build fails if the fixed version cannot be installed. The
+project's own health checks do not use `curl` (they use `cgi-fcgi` and
+`wget`), but the packages belong to the base images and are not removed.
+Remove the upgrade when the pinned base images include the fix. No exception
+was added.
+
 ## Deferred hardening items
 
 - `framework.trusted_hosts` is not configured: behind the edge, Symfony