docker pull node:24-alpinenode@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 4 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 3.9 MB
ADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit - 57 MB
RUN /bin/sh -c addgroup -g 1000 node && adduser -u 1000 -G node -s /bin/sh -D node && apk add --no-cache libatomic libstdc++ && apk add --no-cache --virtual .build-deps gnupg curl && ARCH= OPENSSL_ARCH='linux*' && alpineArch="$(apk --print-arch)" && case "${alpineArch##*-}" in x86_64) ARCH='x64' OPENSSL_ARCH=linux-x86_64;; aarch64) OPENSSL_ARCH=linux-aarch64;; s390x) OPENSSL_ARCH=linux-s390x;; *) echo "unsupported architecture"; exit 1 ;; esac && export GNUPGHOME="$(mktemp -d)" && set -ex && - 1.3 MB
RUN /bin/sh -c apk add --no-cache --virtual .build-deps-yarn curl gnupg tar && export GNUPGHOME="$(mktemp -d)" && for key in 6A010C5166006599AA17F08146C2130DFD2497F5 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; done && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$Y - 441 B
COPY docker-entrypoint.sh /usr/local/bin/ # buildkit
Known vulnerabilities
0Critical0 with a fix
6High6 with a fix
12Medium12 with a fix
1Low1 with a fix
0Unknown0 with a fix
19 findings across 165 packages; 19 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| High | CVE-2026-102276brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns | brace-expansioninstalled 5.0.9 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 |
| High | CVE-2026-102278brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns | brace-expansioninstalled 5.0.9 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 |
| High | CVE-2026-109383undici: undici: Certificate validation bypass via dropped TLS options in Agent | undiciinstalled 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| High | CVE-2026-109869undici: undici: Denial of Service via unhandled stream error on excessive content encodings | undiciinstalled 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| High | CVE-2026-19534undici: undici: Denial of Service via unrequested WebSocket subprotocol | undiciinstalled 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| High | CVE-2026-87018undici: undici: Denial of Service via TLS renegotiation with mismatched certificate | undiciinstalled 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| Medium | CVE-2026-101910ip-address: ip-address: Security boundary bypass via unclassified NAT64 local-use address range | ip-addressinstalled 10.5.0 | 10.5.1 |
| Medium | CVE-2026-101911ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing | ip-addressinstalled 10.5.0 | 10.7.1 |
| Medium | CVE-2026-101912ip-address: ip-address: Access control bypass via cross-family subnet comparison | ip-addressinstalled 10.5.0 | 10.7.1 |
| Medium | CVE-2026-101913ip-address: ip-address: Security bypass via incomplete IPv6 link-local address validation | ip-addressinstalled 10.5.0 | 10.5.1 |
| Medium | CVE-2026-102277brace-expansion: brace-expansion: Denial of Service via crafted brace patterns | brace-expansioninstalled 5.0.9 | 5.0.12, 3.0.9, 2.1.7, 1.1.21 |
| Medium | CVE-2026-104844postcss-selector-parser: postcss-selector-parser: Denial of Service via crafted CSS selectors | postcss-selector-parserinstalled 7.1.4 | 7.1.6, 6.1.5 |
| Medium | CVE-2026-109924undici: undici: Denial of Service via memory exhaustion in EventSource client | undiciinstalled 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| Medium | CVE-2026-109932undici: undici: Denial of Service via unbounded WebSocket PONG buffering | undiciinstalled 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| Medium | CVE-2026-111997ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input | ip-addressinstalled 10.5.0 | 10.7.4 |
| Medium | CVE-2026-118764minimatch: minimatch: Denial of Service via crafted glob pattern expansion | minimatchinstalled 10.2.5 | 11.0.1 |
| Medium | CVE-2026-118773glob: glob: Denial of Service (DoS) via incomplete traversal cancellation | globinstalled 13.0.6 | 14.0.2 |
| Medium | CVE-2026-85024undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression | undiciinstalled 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| Low | CVE-2026-18540undici: undici: HTTP response splitting via retry interceptor | undiciinstalled 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
Packages
- npm packages
- 146
- Alpine packages
- 19
Image configuration
- Base OS
- Alpine Linux 3.24.3
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-entrypoint.sh
- Command
- node
- Exposed ports
- none
- Image created
- 2026-10-28
- amd64 digest
- sha256:4eefa1bfce4197942661ef9148247d779ddf1bb0ee006d3294a467609de60724
Other Node.js tags
node:241,161 MB unpacked · 410 MB downloadC 20H 454M 2001L 1802? 62
node:24-slim236 MB unpacked · 81 MB downloadC 1H 54M 101L 84? 2
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:4eefa1bfce41. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.