Download: https://hub.docker.com/r/humio/pdf-render-service

Bug fixes and updates

Removed

Items that have been removed as of this release.

Installation and Deployment

A second, unused copy of Node.js 24.18.1 has been removed from the image, along with yarn and its package cache. The service has always run on the Node.js from the base image (26.13.0 in this build), so runtime behavior is unchanged. Removing the unused copy prevents false positives in image vulnerability scans.

Upgrades

Changes that may occur or be required during an upgrade.

• Security

  Upgraded body-parser from 2.3.0 to 2.4.0 to address CVE-2026-111181 (CVSS 7.5), where a single request with a compressed body followed by trailing bytes could crash the service process. This service parses JSON request bodies with default options, so it was exposed: any client that could reach the service could stop it with one request.

  Upgraded ip-address from 10.4.0 to 10.7.4 to address CVE-2026-111997, CVE-2026-101910, CVE-2026-101911, CVE-2026-101912, and CVE-2026-101913. This package is only used when the service's outbound proxy is configured with a socks:// URL in the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables. Deployments without a SOCKS proxy are not affected.

• Installation and Deployment

  Upgraded basic-ftp from 5.3.1 to 6.2.1 to address a Regular Expression Denial of Service (ReDoS) flaw, CVE-2026-102990 (CVSS 8.2). This package is only reachable when a proxy is configured through a PAC file served over FTP. This service configures proxies with plain HTTP(S) proxy URLs, so it was not exposed to this issue.

  Upgraded qs from 6.16.1 to 6.17.1 to address CVE-2026-110910. This service was not exposed: it parses URL query strings with Express's default parser (Node.js's built-in parser) and accepts only JSON request bodies, so qs is never called.

Bug Fixes