lowCWE-1104A06:2021

Docker Latest Tag

Using FROM image:latest means a new pull can silently change your base image, breaking reproducibility and potentially introducing vulnerabilities.

How It Works

:latest resolves to whatever the registry considers current at pull time. A new Node.js major version, a changed base OS, or a compromised image being pushed as :latest can change your build without any code change. You lose reproducibility and auditing.

Vulnerable Code
# BAD: latest tag is unpinned — changes without warning
FROM node:latest
FROM postgres:latest
Secure Code
# GOOD: pin to a specific version tag AND digest for full immutability
FROM node:20.11.1-alpine3.19
FROM postgres:16.2-alpine3.19

Real-World Example

In 2020, a maintainer of a popular Docker Hub base image pushed breaking changes to :latest. Thousands of CI builds that relied on it failed simultaneously. More critically, a compromised :latest could silently ship malware to every downstream user.

How to Prevent It

  • Pin base images to specific version tags (node:20.11.1-alpine3.19, not node:latest)
  • For maximum security, pin to the image digest (FROM node@sha256:abc123...) which is immutable
  • Use Dependabot or Renovate to automatically update pinned image versions with reviewed PRs
  • Prefer minimal base images (alpine, distroless) to reduce the attack surface

Affected Technologies

Docker

Data Hogo detects this vulnerability automatically.

Scan Your Repo Free

Related Vulnerabilities