vulnerabilities in docker image ?

[EVOTk]

Hello,
The image analysis reports several vulnerabilities on Node.js Library , umami being a service directly exposed on the internet, I think this is a problem.

I'm not an expert on this, just a curious user :)

https://github.com/aquasecurity/trivy
Result on ghcr.io/mikecao/umami:mysql-latest (alpine 3.15.4)

ghcr.io/mikecao/umami:mysql-latest (alpine 3.15.4)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

2022-06-08T20:01:06.817+0200    INFO    Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Node.js (node-pkg)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 3, CRITICAL: 1)

┌───────────────────────────┬────────────────┬──────────┬───────────────────┬────────────────────────────┬─────────────────────────────────────────────────────────┐
│          Library          │ Vulnerability  │ Severity │ Installed Version │       Fixed Version        │                          Title                          │
├───────────────────────────┼────────────────┼──────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────┤
│ ansi-regex (package.json) │ CVE-2021-3807  │ HIGH     │ 3.0.0             │ 3.0.1, 4.1.1, 5.0.1, 6.0.1 │ nodejs-ansi-regex: Regular expression denial of service │
│                           │                │          │                   │                            │ (ReDoS) matching ANSI escape codes                      │
│                           │                │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2021-3807               │
│                           │                │          ├───────────────────┤                            │                                                         │
│                           │                │          │ 4.1.0             │                            │                                                         │
│                           │                │          │                   │                            │                                                         │
│                           │                │          │                   │                            │                                                         │
├───────────────────────────┼────────────────┼──────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────┤
│ minimist (package.json)   │ CVE-2021-44906 │ CRITICAL │ 1.2.5             │ 1.2.6                      │ minimist: prototype pollution                           │
│                           │                │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2021-44906              │
├───────────────────────────┼────────────────┼──────────┼───────────────────┼────────────────────────────┼─────────────────────────────────────────────────────────┤
│ moment (package.json)     │ CVE-2022-24785 │ HIGH     │ 2.29.1            │ 2.29.2                     │ Moment.js: Path traversal in moment.locale              │
│                           │                │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-24785              │
└───────────────────────────┴────────────────┴──────────┴───────────────────┴────────────────────────────┴─────────────────────────────────────────────────────────┘```

Thx