Node.js 26.13.0

Ubuntu 24.04 · Built from upstream's source

Free image

Docker Hub
docker pull readystack/nodejs:26.13.0-CE-ubuntu24.04-r1
# check it is ours before you run it
cosign verify --key https://readystack.dev/keys/cosign.pub \
  readystack/nodejs:26.13.0-CE-ubuntu24.04-r1
This release on Docker Hub

Hermetic Build Kit

Free with an account

The build kit for this exact release: its pinned base images, source, packages and toolchain, not a copy of the published image. Rebuild, verify and operate it offline, with handbooks checked against the image, seed data, the security report and the defect record.

Free to download for any registered account. ReadyStack does not charge for recipes or build kits; we only ask you to sign up.

Register SLSA provenance on your own builder

Source and build recipe

Public
  • Upstream sourcegithub.com/nodejs/node (v26.13.0) at 18b32a3b1552e199a01f1a8d9fd64aa756d3b75b
  • Base images1 pinned by digest
  • SOURCE_DATE_EPOCH2026-10-23T16:57:46Z
  • Recipe files24, 9 public in full or in part

The pinned inputs, the file list and the opening lines of the Dockerfile and build script are public; every recipe file in full with a free account.

Read the recipeUpstream source

Build trail

Public

How this release passed through ReadyStack's build harness, record by record: every chain, drive, stage, review round, defect and check, each naming the record it is copied from, signed with the release key.

Read the build trail

Grade

ReadyStack's own scan, daily
Original grade
B · 81
pushed and scanned 2026-11-08
How it was scored
  • Medium vulnerabilities with a fix: 2 × −3 = −6
  • Medium vulnerabilities with no fix yet: 59 × −1 = −59
  • +10 Runs as a non-root user (node)
  • +10 Pushed in the last 90 days
  • +5 Signed (cosign)
  • +5 SLSA build provenance attached
  • +5 Provenance names this exact image
  • +3 Standard OCI labels (4 or more)
  • +0 Built for several architectures
  • +3 Matches an upstream GitHub release
  • +3 SBOM attached
  • +2 Docker Hub README shows how to run it

100 −19 = 81. A from 85, B from 70, C from 55, D from 40.

Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-08T06:19:57Z, scored with cerodeo-v2, ce.rodeo's current rubric.

Current grade
B · 81
scanned 2026-11-10C 0 · H 0 · M 61
How it was scored
  • Medium vulnerabilities with a fix: 2 × −3 = −6
  • Medium vulnerabilities with no fix yet: 59 × −1 = −59
  • +10 Runs as a non-root user (node)
  • +10 Pushed in the last 90 days
  • +5 Signed (cosign)
  • +5 SLSA build provenance attached
  • +5 Provenance names this exact image
  • +3 Standard OCI labels (4 or more)
  • +0 Built for several architectures
  • +3 Matches an upstream GitHub release
  • +3 SBOM attached
  • +2 Docker Hub README shows how to run it

100 −19 = 81. A from 85, B from 70, C from 55, D from 40.

Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-08T06:19:57Z, scored with cerodeo-v2, ce.rodeo's current rubric.

A syft SBOM and grype vulnerability matches, scored with cerodeo-v2, ce.rodeo's current rubric (scans before 2026-11-08: cerodeo-v1, the rubric ce.rodeo published until 2026-10-26). The original grade is the first recorded scan of this release, the current grade the latest. All products

This release

As JSON
  • Release tag26.13.0-CE-ubuntu24.04-r1
  • Pushed to Docker Hub2026-11-08
  • linux/amd64 digestsha256:9eef4e36180646c91b9f0ccccc2ed60a341e1dd2f16b530ecb64bde999912943
  • Offline rebuildRebuilt bit-for-bit on 2026-11-08 with the network off
  • SignatureSigned (key 04daa92344a52dbc)
  • Runs asNon-root (node)
  • AttestationsSBOM (SPDX) and SLSA provenance v1
  • Defects2 found in review, fixed before release
    Report an issue