Security vulnerability detected in nginx image (CVE-2026-45447)

Bug Overview

During a security scan of my project, I detected a vulnerability in the nginx image.

The vulnerability is associated with package(s) from Alpine 3.23.4 and is also reported when scanning the corresponding image from Docker Hub.

CVE: CVE-2026-45447

Please investigate and provide a fix or an updated image containing the patched package.

Expected Behavior

The nginx image should not contain packages affected by CVE-2026-45447.

A patched image or updated package version should be provided to address the vulnerability.

Steps to Reproduce the Bug

1. Pull the affected image:
   docker pull nginx:

2. Scan the image using Trivy:
   trivy image nginx:

3. Check the vulnerability report.

4. CVE-2026-45447 is detected in the affected package.

Detected vulnerability:
Vulnerable Package
libcrypto3:3.5.6-r0

Environment Details

• Version/release of Docker and method of installation (e.g. Docker Desktop / Docker Server)
• Version of the Docker NGINX image or specific commit: [e.g. 1.4.3/commit hash]
• Target deployment platform: [e.g. OpenShift/Kubernetes/Docker Compose/local cluster/etc...]
• Target OS: [e.g. RHEL 9/Ubuntu 24.04/etc...]

Additional Context

No response

Start by identifying the affected nginx image version and reproducing the report with Trivy using the image and package details in the issue. Check the image's Alpine package metadata and the corresponding Docker build configuration for the libcrypto3 version. Done means an updated image is available without CVE-2026-45447, with the scan confirming the fix.