When will a release be created to fix a High Severity Vulnerability in Hydrogen-Alpine?

[Appstute-Arati]

CVE ID: GHSA-3xgq-45jj-v275
Severity: High
Description: The vulnerability allows an attacker to exploit an insecure configuration or flaw in the container to gain unauthorized access, escalate privileges, or execute arbitrary code remotely.

This high severity vulnerability has been resolved in NPM and the fix to bump the version was merged 3 days ago (nodejs/node#55951) but there still isn't a new release with this fix so the Docker images still have this vulnerability present, which is blocking my team from releasing new code. Is there an ETA on the next release (18.20.6)?

[yosifkit]

Once there is a release of an updated node that bundles an updated npm, then the docker images will be updated. See also #2164

Other relevant comments and issues:

• updated npm in node 18 and 20 is held up: deps: upgrade npm to 10.9.1 node#55951 (comment)
• more about the npm hold up in: Upgrade nodejs to latest npm version 10.9.1 nodejs-dependency-vuln-assessments#193
• interesting comment calling this CVE a false positive: Upgrade nodejs to latest npm version 10.9.1 nodejs-dependency-vuln-assessments#193 (comment)