diff --git a/docker/edge/caddy/go.mod b/docker/edge/caddy/go.mod
index fe1e928..270337d 100644
--- a/docker/edge/caddy/go.mod
+++ b/docker/edge/caddy/go.mod
@@ -47,7 +47,7 @@ require (
 	github.com/fxamacker/cbor/v2 v2.9.4 // indirect
 	github.com/go-chi/chi/v5 v5.3.2 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.6 // indirect
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-sql-driver/mysql v1.10.1 // indirect
diff --git a/docker/edge/caddy/go.sum b/docker/edge/caddy/go.sum
index 5f3c502..b123e78 100644
--- a/docker/edge/caddy/go.sum
+++ b/docker/edge/caddy/go.sum
@@ -161,8 +161,8 @@ github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY=
 github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
 github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
diff --git a/docs/security/container-vulnerabilities.md b/docs/security/container-vulnerabilities.md
index bf58b60..b4c9bac 100644
--- a/docs/security/container-vulnerabilities.md
+++ b/docs/security/container-vulnerabilities.md
@@ -77,7 +77,9 @@ clean) with
 `golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca`
 and `golang.org/x/net` 0.60.0; the official 2.11.7 image provides the base
 layer. `caddy version` reports `v2.11.7`. Result: **0 HIGH/CRITICAL** (was 24
-with the 2.11.4 release binary, 5 with the 2.11.7 release binary).
+with the 2.11.4 release binary, 5 with the 2.11.7 release binary). Since
+2026-10-27 the binary has a `go-jose` finding again; see
+[CVE-2026-116587](#cve-2026-116587--ghsa-mgcc-cww5-fp2q-go-jose-edge).
 
 Triage of the 2.11.4 release binary:
 
@@ -185,6 +187,45 @@ project's own health checks do not use `curl` (they use `cgi-fcgi` and
 Remove the upgrade when the pinned base images include the fix. No exception
 was added.
 
+## CVE-2026-116587 / GHSA-mgcc-cww5-fp2q: `go-jose` (edge)
+
+Published by go-jose on 2026-10-14 and added to the GitHub advisory database
+(HIGH) on 2026-10-27, after the last green scan of `main` (run 40407409241,
+2026-10-26); found by the scan of PR #40 (run 40671261985, 2026-10-28), not
+caused by a change of the project. Parsing a JWK with a crafted RSA key
+costs excessive CPU (denial of service). The rebuilt Caddy binary
+(`usr/bin/caddy`, edge `prod` and `dev`) contains both affected major
+versions:
+
+| Package | Installed | Fixed in | Status |
+|---|---|---|---|
+| `github.com/go-jose/go-jose/v4` | 4.1.5 | 4.1.6 | **fixed**: `docker/edge/caddy/go.mod` requires 4.1.6 |
+| `github.com/go-jose/go-jose/v3` | 3.0.5 | none (no fixed v3 release) | **open** |
+
+`go-jose/v3` comes from `modules/caddypki` → `github.com/smallstep/certificates/authority`
+→ `go.step.sm/crypto/jose` (0.91.0; the newest, 0.91.1, still requires
+v3). It cannot be removed by building Caddy without `modules/caddypki`:
+`modules/caddytls` (internal issuer and CA pools) and
+`caddyconfig/httpcaddyfile` import `caddypki` directly, and
+`modules/caddyhttp` imports `caddytls`, so every Caddy build with the HTTP
+app links it. A build from the `modules/standard` list without `caddypki`
+and `caddypki/acmeserver` still contains `go-jose/v3` 3.0.5 (`go version -m`)
+and only drops the `http.handlers.acme_server` module. Removing v3 needs
+either a release of `go.step.sm/crypto` and `smallstep/certificates` on
+go-jose v4, or a change to Caddy itself.
+
+FlowCRM's configuration does not reach the vulnerable code: both
+Caddyfiles disable automatic HTTPS (`auto_https off`), no configuration
+defines a `pki` app, `tls internal` or `acme_server`, and the HTTPS test
+edge (`tests/app/https`) loads its certificate from files
+(`tls.certificates.load_files`). Only the `acme_server` handler passes
+untrusted input (the JWS of an ACME request) to the vulnerable parser;
+`tls internal` and the `pki` app parse only keys Caddy creates or loads
+from its own configuration. With `admin off` the configuration cannot be
+changed at run time. The finding still fails the runtime gate
+for the edge `prod` image until it is fixed upstream or an exception is
+decided.
+
 ## Deferred hardening items
 
 - `framework.trusted_hosts` is not configured: behind the edge, Symfony