uptime-kuma

Image · Observability · standard · v2.5.6

D 17cosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-22

Uptime Kuma, the self-hosted uptime monitor and status-page server (HTTP, TCP, ping, DNS, database and more). The tagged server with pinned npm production deps and the release's prebuilt UI on Node 24; SQLite in DATA_DIR by default.

Current digest (deployed by the chart)

sha256:76bb9db001b076cfa4a015150ade642dfb7bc05f2d49a810abe9897bbc203a87

Signatures, the SBOM, and provenance all attach to this digest. Pin to it for reproducible, tamper-evident pulls.

Image

ghcr.io/quenchworks/images/uptime-kuma:2.5.6

Signed

cosign keyless

SBOM

SPDX, on digest

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Image size

108.0 MB

Published versions

1 tag

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Version	Size	Published	Digest
2.5.6latest	108.0 MB	2026-10-22	sha256:76bb9db001b0…

Security report (Trivy)

D· 0/10017 fixable · rebuild clears them

Vulnerability detail

uptime-kuma 2.5.6 · 17 CVE

CVE	Severity	Package	Installed	Fixed in	Title
CVE-2026-109383	HIGH	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Certificate validation bypass via dropped TLS options in Agent
CVE-2026-109461	HIGH	@azure/msal-node	5.6.0	7.1.0	MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109869	HIGH	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via unhandled stream error on excessive content encodings
CVE-2026-111181	HIGH	body-parser	1.20.8	2.4.0, 1.20.9	body-parser: body-parser: Denial of Service via unhandled decompression stream error
CVE-2026-116689	HIGH	follow-redirects	1.16.1	1.16.2	follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
CVE-2026-87018	HIGH	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
CVE-2026-109924	MEDIUM	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via memory exhaustion in EventSource client
CVE-2026-109932	MEDIUM	undici	6.28.1	6.29.1, 7.30.1, 8.12.2	undici: undici: Denial of Service via unbounded WebSocket PONG buffering
CVE-2026-110816	MEDIUM	qs	6.16.0	6.16.1	qs: qs: Denial of Service via unhandled exception during array serialization
CVE-2026-111997	MEDIUM	ip-address	10.7.2	10.7.4	ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input
CVE-2026-118764	MEDIUM	minimatch	9.0.7	11.0.1	minimatch: minimatch: Denial of Service via crafted glob pattern expansion
CVE-2026-118773	MEDIUM	glob	10.5.0	14.0.2	glob: glob: Denial of Service (DoS) via incomplete traversal cancellation
GHSA-4ffr-jq9g-5ffx	MEDIUM	nodemailer	10.0.10	10.0.13	Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-85x2-q946-cp5h	MEDIUM	nodemailer	10.0.10	10.1.4	Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
GHSA-8c8m-p3m8-cjg8	MEDIUM	nodemailer	10.0.10	10.1.4	Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
GHSA-g73g-hqqh-jr95	MEDIUM	nodemailer	10.0.10	10.0.13	Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-m943-m63m-w62w	MEDIUM	nodemailer	10.0.10	10.1.4	Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Critical

High

Medium

Low

Unknown

fixable per nightly scan · peak 167 of 115 days with any · 2026-06-29 to 2026-10-22

Pull the image

Run it directly with Docker, Podman, or any Kubernetes workload. Nonroot, read-only root filesystem, built for amd64 and arm64.

Pull (tag)

docker pull ghcr.io/quenchworks/images/uptime-kuma:2.5.6

Pinned by digest (recommended)

docker pull ghcr.io/quenchworks/images/uptime-kuma@sha256:76bb9db001b076cfa4a015150ade642dfb7bc05f2d49a810abe9897bbc203a87

Tags

2.5.62.5.6-amd642.5.6-arm64

Images are tagged by app version (never :latest): a multi-arch index plus per-arch tags.

App version: 2.5.6
Architectures: amd64, arm64
Runs as: nonroot (uid 1001)
Root filesystem: read-only
License: MIT

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three yourself:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/uptime-kuma:2.5.6 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/uptime-kuma:2.5.6 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/uptime-kuma:2.5.6 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Transparency

Every image carries its SBOM and provenance as attestations on the same digest, publicly verifiable with the commands above (they check the package and the Sigstore transparency log, Rekor).

View the Helm chart View package

Upstream project: https://uptime.kuma.pet