node:24 image size, layers and vulnerabilities (2026-11-01)

docker pull node:24node@sha256:e7add2a490bb17d97b485b8641bd88455fff7839ade0f5eba493c3508124d413

Size per platform

Compressed download size on Docker Hub for each architecture.

ppc64le427 MB
amd64410 MB
arm64401 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/lib/x86_64-linux-gnu358 MB
/usr/local/bin127 MB
/usr/lib/gcc125 MB
/usr/bin111 MB
/usr/share/locale88 MB
/usr/local/include61 MB
/usr/share/doc50 MB
/usr/lib/python3.1127 MB
/usr/lib/python325 MB
/usr/lib/git-core24 MB

Layers

The 8 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (debian)49 MB
2. RUN … apt-get install24 MB
3. RUN … apt-get install64 MB
4. RUN … apt-get install212 MB
5. RUN … create user3 kB
6. RUN dpkgArch="$(dpkg --print-architec60 MB
7. RUN … download1.3 MB
8. COPY docker-entrypoint.sh → /usr/loca447 B

Full build steps

49 MB# debian.sh --arch 'amd64' out/ 'bookworm' '@1793059200'
24 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates curl gnupg netbase sq wget ; rm -rf /var/lib/apt/lists/* # buildkit
64 MBRUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends git mercurial openssh-client subversion procps ; rm -rf /var/lib/apt/lists/* # buildkit
212 MBRUN /bin/sh -c set -ex; apt-get update; apt-get install -y --no-install-recommends autoconf automake bzip2 default-libmysqlclient-dev dpkg-dev file g++ gcc imagemagick libbz2-dev libc6-dev libcurl4-openssl-dev libdb-dev libevent-dev libffi-dev libgdbm-dev libglib2.0-dev libgmp-dev libjpeg-dev libkrb5-dev liblzma-dev libmagickcore-dev libmagickwand-dev libmaxminddb-dev libncurses5-dev libncursesw5-dev libpng-dev libpq-dev libreadline-dev libsqlite3-dev libssl-dev libtool libwebp-dev libxml2-dev libxslt-dev libyaml-dev m
3 kBRUN /bin/sh -c groupadd --gid 1000 node && useradd --uid 1000 --gid node --shell /bin/bash --create-home node # buildkit
60 MBRUN /bin/sh -c ARCH= && dpkgArch="$(dpkg --print-architecture)" && case "${dpkgArch##*-}" in amd64) ARCH='x64';; ppc64el) ARCH='ppc64le';; arm64) ARCH='arm64';; *) echo "unsupported architecture"; exit 1 ;; esac && export GNUPGHOME="$(mktemp -d)" && set -ex && for key in 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 CC68F5A3106FF448322E48ED27F5E38D5B0A215F 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C 108F52B48DB57BB0CC439B2997B01419BD92F80A 655F3B5C1FB3FA8D1A0CA6BDE4A7
1.3 MBRUN /bin/sh -c set -ex && export GNUPGHOME="$(mktemp -d)" && for key in 6A010C5166006599AA17F08146C2130DFD2497F5 ; do { gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; done && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz" && curl -fsSLO --compressed "https://yarnpkg.com/downloads/$YARN_VERSION/yarn-v$YARN_VERSION.tar.gz.asc" && gpg --batch --verify yar
447 BCOPY docker-entrypoint.sh /usr/local/bin/ # buildkit

Known vulnerabilities

20Critical0 with a fix

454High19 with a fix

2001Medium131 with a fix

1802Low261 with a fix

62Unknown27 with a fix

4339 findings across 559 packages; 438 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Critical	CVE-2023-45853zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6	zlib1g, zlib1g-devinstalled 1:1.2.13.dfsg-1	no fix yet
Critical	CVE-2023-5841OpenEXR: Heap Overflow in Scanline Deep Data Parsing	libopenexr-3-1-30, libopenexr-devinstalled 3.1.5-5	no fix yet
Critical	CVE-2023-6879aom: heap-buffer-overflow on frame size change	libaom3installed 3.6.0-1+deb12u3	no fix yet
Critical	CVE-2025-7458sqlite: SQLite integer overflow	libsqlite3-0, libsqlite3-devinstalled 3.40.1-2+deb12u2	no fix yet
Critical	CVE-2026-42216OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files	libopenexr-3-1-30, libopenexr-devinstalled 3.1.5-5	no fix yet
Critical	CVE-2026-42217OpenEXR: OpenEXR: Information disclosure via malformed EXR image file processing	libopenexr-3-1-30, libopenexr-devinstalled 3.1.5-5	no fix yet
Critical	CVE-2026-58016glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"	libglib2.0-0, libglib2.0-bin, libglib2.0-data, libglib2.0-dev +1 moreinstalled 2.74.6-2+deb12u9	no fix yet
Critical	CVE-2026-60002openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side	openssh-clientinstalled 1:9.2p1-2+deb12u10	no fix yet
Critical	CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free	libxml2, libxml2-devinstalled 2.9.14+dfsg-1.3~deb12u6	no fix yet
Critical	CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate()	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2026-102276brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns	brace-expansioninstalled 5.0.9	5.0.10, 3.0.7, 2.1.5, 1.1.19
High	CVE-2026-102278brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns	brace-expansioninstalled 5.0.9	5.0.11, 3.0.8, 2.1.6, 1.1.20
High	CVE-2026-109383undici: undici: Certificate validation bypass via dropped TLS options in Agent	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
High	CVE-2026-109869undici: undici: Denial of Service via unhandled stream error on excessive content encodings	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
High	CVE-2026-116149ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images	imagemagick, imagemagick-6-common, imagemagick-6.q16, libmagickcore-6-arch-config +9 moreinstalled 8:6.9.11.60+dfsg-1.6+deb12u14	8:6.9.11.60+dfsg-1.6+deb12u15
High	CVE-2026-19534undici: undici: Denial of Service via unrequested WebSocket subprotocol	undiciinstalled 6.28.0	6.28.1, 7.29.1, 8.10.2
High	CVE-2026-87018undici: undici: Denial of Service via TLS renegotiation with mismatched certificate	undiciinstalled 6.28.0	6.29.1, 7.30.1, 8.12.2
High	CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2021-3847kernel: low-privileged user privileges escalation	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2023-25193harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks	libharfbuzz0binstalled 6.0.0+dfsg-3	no fix yet
High	CVE-2023-2953openldap: null pointer dereference in ber_memalloc_x function	libldap-2.5-0installed 2.5.13+dfsg-5	no fix yet
High	CVE-2023-39616AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read mem ...	libaom3installed 3.6.0-1+deb12u3	no fix yet
High	CVE-2023-52355libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM	libtiff-dev, libtiff6, libtiffxx6installed 4.5.0-6+deb12u4	no fix yet
High	CVE-2023-52452kernel: bpf: Fix accesses to uninit stack slots	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2023-52586kernel: drm/msm/dpu: Add mutex lock in control vblank irq	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2023-52624kernel: drm/amd/display: Wake DMCUB before executing GPINT commands	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2023-52751kernel: smb: client: fix use-after-free in smb2_query_info_compound()	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2023-53218kernel: rxrpc: Make it so that a waiting process can be aborted	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-26669kernel: net/sched: flower: Fix chain template offload	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-26836kernel: platform/x86: think-lmi: Fix password opcode ordering for workstations	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-26913kernel: drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-26914kernel: drm/amd/display: fix incorrect mpc_combine array size	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-26944kernel: btrfs: zoned: fix use-after-free in do_zone_finish()	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-38570kernel: gfs2: Fix potential glock use-after-free on unmount	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-38630kernel: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger	linux-libc-devinstalled 6.1.190-1	no fix yet
High	CVE-2024-41045kernel: bpf: Defer work in bpf_timer_cancel_and_free	linux-libc-devinstalled 6.1.190-1	no fix yet

Showing the 40 most severe of 2,527 distinct vulnerabilities (4339 findings, one per affected package).

Packages

Debian packages: 413
npm packages: 146

Image configuration

Base OS: Debian 12.15 (bookworm)
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: docker-entrypoint.sh
Command: node
Exposed ports: none
Image created: 2026-10-28
amd64 digest: sha256:8544b46b91d1a8c8bf8fc0d53ae9f276ed07d0ffa9098dc4a9c2f627363a13a0

Other Node.js tags

node:24-slim236 MB unpacked · 81 MB downloadC 1H 54M 101L 84? 2 node:24-alpine175 MB unpacked · 62 MB downloadH 6M 12L 1

node:24 vs node:24-alpine

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:8544b46b91d1. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.