node:24-slim image size, layers and vulnerabilities (2026-11-01)

docker pull node:24-slimnode@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c

Size per platform

Compressed download size on Docker Hub for each architecture.

ppc64le88 MB
amd6481 MB
arm6481 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/local/bin127 MB
/usr/lib/x86_64-linux-gnu39 MB
/usr/bin21 MB
/usr/local/lib13 MB
/usr/sbin6.3 MB
/usr/local/include5.7 MB
/opt/yarn-v1.22.225.3 MB
/var/lib2.7 MB
/var/cache1.6 MB
/usr/share/zoneinfo1.3 MB

Layers

The 5 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (debian)28 MB
2. RUN … create user3 kB
3. RUN … apt-get install51 MB
4. RUN … apt-get install1.7 MB
5. COPY docker-entrypoint.sh → /usr/loca449 B

Full build steps

28 MB# debian.sh --arch 'amd64' out/ 'bookworm' '@1793059200'
3 kBRUN /bin/sh -c groupadd --gid 1000 node && useradd --uid 1000 --gid node --shell /bin/bash --create-home node # buildkit
51 MBRUN /bin/sh -c ARCH= OPENSSL_ARCH= && dpkgArch="$(dpkg --print-architecture)" && case "${dpkgArch##*-}" in amd64) ARCH='x64' OPENSSL_ARCH='linux-x86_64';; ppc64el) ARCH='ppc64le' OPENSSL_ARCH='linux-ppc64le';; arm64) ARCH='arm64' OPENSSL_ARCH='linux-aarch64';; *) echo "unsupported architecture"; exit 1 ;; esac && set -ex && apt-get update && apt-get install -y ca-certificates curl wget gnupg dirmngr xz-utils libatomic1 --no-install-recommends && rm -rf /var/lib/apt/lists/* && export GNUPGHOME="$(mktemp -d)" && for key in 5BE8A3F6C8A5C01
1.7 MBRUN /bin/sh -c set -ex && savedAptMark="$(apt-mark showmanual)" && apt-get update && apt-get install -y ca-certificates curl wget gnupg dirmngr --no-install-recommends && rm -rf /var/lib/apt/lists/* && export GNUPGHOME="$(mktemp -d)" && for key in 6A010C5166006599AA17F08146C2130DFD2497F5 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; done && curl -fsSLO --compressed "https://yarnpkg.com/downlo
449 BCOPY docker-entrypoint.sh /usr/local/bin/ # buildkit

Known vulnerabilities

1Critical0 with a fix

54High6 with a fix

101Medium12 with a fix

84Low1 with a fix

2Unknown1 with a fix

242 findings across 234 packages; 20 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Critical	CVE-2023-45853zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6	zlib1ginstalled 1:1.2.13.dfsg-1	no fix yet
High	CVE-2026-102276brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns	brace-expansioninstalled 5.0.9	5.0.10, 3.0.7, 2.1.5, 1.1.19
High	CVE-2026-102278brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns	brace-expansioninstalled 5.0.9	5.0.11, 3.0.8, 2.1.6, 1.1.20
High	CVE-2026-109383undici: undici: Certificate validation bypass via dropped TLS options in Agent	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
High	CVE-2026-109869undici: undici: Denial of Service via unhandled stream error on excessive content encodings	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
High	CVE-2026-19534undici: undici: Denial of Service via unrequested WebSocket subprotocol	undiciinstalled 6.28.0	6.28.1, 7.29.1, 8.10.2
High	CVE-2026-87018undici: undici: Denial of Service via TLS renegotiation with mismatched certificate	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
High	CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution.	libtinfo6, ncurses-base, ncurses-bininstalled 6.4-4	no fix yet
High	CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification	libsystemd0, libudev1installed 252.39-1~deb12u2	no fix yet
High	CVE-2026-41992gzip: gzip: Information disclosure via global buffer overflow in LZH decompression	gzipinstalled 1.12-1	no fix yet
High	CVE-2026-53613util-linux: TOCTOU in the mount program via ancestor directory swap on target path	bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3	no fix yet
High	CVE-2026-53615util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser	bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3	no fix yet
High	CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions	libacl1installed 2.3.1-3	no fix yet
High	CVE-2026-76642util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks	bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3	no fix yet
High	CVE-2026-78408util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority	bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3	no fix yet
High	CVE-2026-78410util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection	bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3	no fix yet
High	CVE-2026-9538perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size	perl-baseinstalled 5.36.0-7+deb12u4	no fix yet
Medium	CVE-2026-101910ip-address: ip-address: Security boundary bypass via unclassified NAT64 local-use address range	ip-addressinstalled 10.5.0	10.5.1
Medium	CVE-2026-101911ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing	ip-addressinstalled 10.5.0	10.7.1
Medium	CVE-2026-101912ip-address: ip-address: Access control bypass via cross-family subnet comparison	ip-addressinstalled 10.5.0	10.7.1
Medium	CVE-2026-101913ip-address: ip-address: Security bypass via incomplete IPv6 link-local address validation	ip-addressinstalled 10.5.0	10.5.1
Medium	CVE-2026-102277brace-expansion: brace-expansion: Denial of Service via crafted brace patterns	brace-expansioninstalled 5.0.9	5.0.12, 3.0.9, 2.1.7, 1.1.21
Medium	CVE-2026-104844postcss-selector-parser: postcss-selector-parser: Denial of Service via crafted CSS selectors	postcss-selector-parserinstalled 7.1.4	7.1.6, 6.1.5
Medium	CVE-2026-109924undici: undici: Denial of Service via memory exhaustion in EventSource client	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
Medium	CVE-2026-109932undici: undici: Denial of Service via unbounded WebSocket PONG buffering	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
Medium	CVE-2026-111997ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input	ip-addressinstalled 10.5.0	10.7.4
Medium	CVE-2026-118764minimatch: minimatch: Denial of Service via crafted glob pattern expansion	minimatchinstalled 10.2.5	11.0.1
Medium	CVE-2026-118773glob: glob: Denial of Service (DoS) via incomplete traversal cancellation	globinstalled 13.0.6	14.0.2
Medium	CVE-2026-85024undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression	undiciinstalled 6.28.0	6.28.1, 7.29.1, 8.10.2
Medium	CVE-2023-50495ncurses: segmentation fault via _nc_wrap_entry()	libtinfo6, ncurses-base, ncurses-bininstalled 6.4-4	no fix yet
Medium	CVE-2024-10041pam: libpam: Libpam vulnerable to read hashed password	libpam-modules, libpam-modules-bin, libpam-runtime, libpam0ginstalled 1.5.2-6+deb12u2	no fix yet
Medium	CVE-2025-30258gnupg: verification DoS due to a malicious subkey in the keyring	gpgvinstalled 2.2.40-1.1+deb12u2	no fix yet
Medium	CVE-2025-68972gnupg: GnuPG: Signature bypass via form feed character in signed messages	gpgvinstalled 2.2.40-1.1+deb12u2	no fix yet
Medium	CVE-2026-102010gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if	gcc-12-base, libgcc-s1, libstdc++6installed 12.2.0-14+deb12u1	no fix yet
Medium	CVE-2026-13595util-linux: util-linux: heap use-after-free in libblkid nested partition probing	bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3	no fix yet
Medium	CVE-2026-13757p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing	libp11-kit0installed 0.24.1-2	no fix yet
Medium	CVE-2026-15059systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API	libsystemd0, libudev1installed 252.39-1~deb12u2	no fix yet
Medium	CVE-2026-15534perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine.	perl-baseinstalled 5.36.0-7+deb12u4	no fix yet
Medium	CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string	libc-bin, libc6installed 2.36-9+deb12u14	no fix yet
Medium	CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape	tarinstalled 1.34+dfsg-1.2+deb12u1	no fix yet

Showing the 40 most severe of 119 distinct vulnerabilities (242 findings, one per affected package).

Packages

npm packages: 146
Debian packages: 88

Image configuration

Base OS: Debian 12.15 (bookworm)
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: docker-entrypoint.sh
Command: node
Exposed ports: none
Image created: 2026-10-28
amd64 digest: sha256:a43f7fc3e52e87d12a905f46eea0275def84ca8f2981a5b53fed44d7fb398ee0

Other Node.js tags

node:241,161 MB unpacked · 410 MB downloadC 20H 454M 2001L 1802? 62 node:24-alpine175 MB unpacked · 62 MB downloadH 6M 12L 1

node:24-slim vs node:24-alpine

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:a43f7fc3e52e. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.