A monitoring system identified 15 critical and high-severity vulnerabilities in October affecting PHP, Nginx, Node.js, Next.js, Java, and GitLab. The author manually reviewed each entry to determine actual impact, discovering that some vulnerabilities were specific to certain configurations or libraries rather than the software versions themselves.
The author found that their Nginx instance was outdated by 1.5 days due to the timing of the unattended-upgrades service. While the specific Nginx vulnerabilities did not match the author's configuration, the author updated their monitoring policy to trigger alerts for any security updates pending for more than 24 hours.
Node.js was found to be outdated because it was installed via the NodeSource repository, which is not covered by the standard Ubuntu unattended-upgrades process. The author manually updated Node.js and emphasized the importance of restarting services after updates, as processes often continue running the old version from memory.
A critical vulnerability in the librsvg library, which affects SVG processing, was identified within the sharp library. This poses a risk to any service that processes user-uploaded SVG files, regardless of whether the application uses Next.js or other frameworks that rely on sharp for image optimization.
To maintain security, the author recommends checking package changelogs for specific CVEs using apt-get changelog rather than relying solely on version numbers. Additionally, the author suggests using tools like needrestart to identify processes that are still running outdated binaries or libraries after an update.
