# Use of Unmaintained Third Party Components (CWE-1104) The product relies on third-party components that are no longer being maintained by the original developer or by the open source community. - Prevalence: Medium 2 languages covered - Impact: Medium Review recommended - Prevention: Documented 5 fix examples **OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5 ## Description Without ongoing maintenance, newly discovered vulnerabilities in these components will not be patched. This creates an increasing risk as time passes and vulnerabilities are discovered. ## Prevention Prevention strategies for Use of Unmaintained Third Party based on 5 Shoulder detection rules. ### Docker Pin base images to specific version tags or SHA digests for reproducible builds Use npm ci instead of npm install for deterministic, reproducible Docker builds Update FROM to a supported Node.js LTS version (24-alpine or 22-alpine) ### Node.js Update .nvmrc to a supported Node.js LTS version (22 or 20) Align Node.js versions across .nvmrc, Dockerfile, and package.json to the same LTS version ## Warning Signs - [MEDIUM] Dockerfile uses ...: ... - [MEDIUM] base images using "latest" tag or missing version tags - [MEDIUM] Dockerfile uses ... which is end-of-life or outdated. IMPORTANT: Update to node:24-alpine (Active LTS) or node:22-alpine - [MEDIUM] Dockerfiles using outdated or end-of-life Node - [MEDIUM] .nvmrc specifies ... - [MEDIUM] Node.js versions are inconsistent across configuration files. Check the docker-image-outdated finding for the latest rec - [MEDIUM] inconsistent Node - [LOW] Dockerfile uses 'npm install' - consider 'npm ci' for reproducible builds. ## Consequences - Execute Unauthorized Code - Read Application Data - DoS ## Mitigations - Regularly audit and update third-party dependencies - Establish a process for monitoring component vulnerabilities - Have a plan to replace unmaintained components ## Detection - Total rules: 5 - Languages: dockerfile, javascript ## Rules by Language ### Dockerfile (4 rules) - **Docker Base Image Security** [MEDIUM]: Detects base images using "latest" tag or missing version tags. - Remediation: Use specific version tags for base images. ```dockerfile FROM node:24-alpine ``` Learn more: https://shoulder.dev/learn/docker/cwe-1104/base-image-security - **Use npm ci for Reproducible Builds** [LOW]: Detects Dockerfiles using `npm install` instead of `npm ci` for production builds. - Remediation: Use `npm ci` instead of `npm install` for reproducible builds. ```dockerfile RUN npm ci ``` Learn more: https://shoulder.dev/learn/docker/cwe-1104/npm-ci - **Dockerfile Uses Outdated Node.js Version** [MEDIUM]: Detects Dockerfiles using outdated or end-of-life Node.js versions. - Remediation: Update to a supported Node.js LTS version. ```dockerfile FROM node:24-alpine ``` Learn more: https://shoulder.dev/learn/docker/cwe-1104/outdated-node-version - **Node.js Version Mismatch Between Configuration Files** [MEDIUM]: Detects inconsistent Node.js versions across project configuration files. When .nvmrc specifies one Node.js version but Dockerfile uses a different version, it causes environment drift: - "Works on my machine" bugs (code works locally but fails in production) - Security inconsistencies (development may use patched version while production uses vulnerable version) - Dependency incompatibilities (npm packages may behave differently) - Debugging difficulties (hard to reproduce production issues locally) This rule detects mismatches between: - .nvmrc and Dockerfile - .nvmrc and package.json engines - .tool-versions and Dockerfile NOTE: Detection is handled by internal/frameworks/nodejs/detector.go. The actual recommended version comes from the docker-image-outdated finding which uses the Docker image API for real-time version data. - Remediation: Align ALL configuration files to use the SAME Node.js version. IMPORTANT: Check the docker-image-outdated finding for the LATEST version. The API provides real-time version recommendations. After determining the latest version from docker-image-outdated, update: - Dockerfile: FROM node:-alpine - .nvmrc: - package.json engines.node: ">=.0.0" NEVER downgrade. Always use the NEWER version shown in docker-image-outdated. ### Javascript (2 rules) - **.nvmrc Specifies Outdated Node.js Version** [MEDIUM]: Detects .nvmrc files specifying outdated or end-of-life (EOL) Node.js versions. The .nvmrc file is used by Node Version Manager (nvm) to automatically switch to the correct Node.js version for a project. When this file specifies an outdated version, developers may be running insecure or incompatible Node.js versions in their development environments. Node.js version lifecycle (as of 2025): - Node 14.x: EOL April 2023 - Node 16.x: EOL September 2023 - Node 18.x: EOL April 2025 - Node 20.x: Maintenance LTS (until April 2026) - Node 22.x: Active LTS (until April 2027) - Node 23.x: Current (non-LTS) This causes: - Security vulnerabilities from missing patches - Inconsistent behavior between development and production - Compatibility issues with modern npm packages NOTE: This rule uses static version patterns. Review and update when new even-numbered LTS versions are released (typically October each year). Next update needed: October 2025 for Node.js 24 LTS. - Remediation: Update .nvmrc to a supported Node.js LTS version (20.x or 22.x). - **Node.js Version Mismatch Between Configuration Files** [MEDIUM]: Detects inconsistent Node.js versions across project configuration files. When .nvmrc specifies one Node.js version but Dockerfile uses a different version, it causes environment drift: - "Works on my machine" bugs (code works locally but fails in production) - Security inconsistencies (development may use patched version while production uses vulnerable version) - Dependency incompatibilities (npm packages may behave differently) - Debugging difficulties (hard to reproduce production issues locally) This rule detects mismatches between: - .nvmrc and Dockerfile - .nvmrc and package.json engines - .tool-versions and Dockerfile NOTE: Detection is handled by internal/frameworks/nodejs/detector.go. The actual recommended version comes from the docker-image-outdated finding which uses the Docker image API for real-time version data. - Remediation: Align ALL configuration files to use the SAME Node.js version. IMPORTANT: Check the docker-image-outdated finding for the LATEST version. The API provides real-time version recommendations. After determining the latest version from docker-image-outdated, update: - Dockerfile: FROM node:-alpine - .nvmrc: - package.json engines.node: ">=.0.0" NEVER downgrade. Always use the NEWER version shown in docker-image-outdated.