Node.js 16构建Node-RED Docker镜像时npm audit fix报错求助

问题 #

我有一个用于Node-RED的Dockerfile，基础镜像使用FROM node:16-buster-slim，构建阶段执行以下命令：

RUN npm -i install && npm audit fix --force && npm run build && rm -rf node_modules && npm install --production 

升级到Node.js 16版本后，构建时出现漏洞报错，执行npm audit fix --force失败导致构建终止；但使用Node.js 14版本时构建可正常完成。报错详情如下：

#23 66.90 markdown  *
#23 66.90 Regular Expression Denial of Service in markdown
#23 66.90 fix available via `npm audit fix`
#23 66.90 node_modules/markdown
#23 66.90 
#23 66.90 marked  <=4.0.9
#23 66.90 Severity: high
#23 66.90 Multiple Content Injection Vulnerabilities in marked
#23 66.90 Moderate severity vulnerability that affects marked
#23 66.90 Inefficient Regular Expression Complexity in marked
#23 66.90 Inefficient Regular Expression Complexity in marked
#23 66.90 Sanitization bypass using HTML Entities in marked
#23 66.90 Regular Expression Denial of Service in marked
#23 66.90 VBScript Content Injection in marked
#23 66.90 Regular Expression Denial of Service in marked
#23 66.90 fix available via `npm audit fix`
#23 66.90 node_modules/jsdoc3/node_modules/marked
#23 66.90 
#23 66.90 minimatch  <=3.0.4
#23 66.90 Severity: high
#23 66.90 Regular Expression Denial of Service in minimatch
#23 66.90 minimatch ReDoS vulnerability
#23 66.90 fix available via `npm audit fix`
#23 66.90 node_modules/jsdoc3/node_modules/minimatch
#23 66.90 
#23 66.90 sanitize-html  <=2.3.1
#23 66.90 Severity: moderate
#23 66.90 Improper Input Validation in sanitize-html
#23 66.90 Improper Input Validation in sanitize-html
#23 66.90 fix available via `npm audit fix`
#23 66.90 node_modules/sanitize-html
#23 66.90   ink-docstrap  >=1.0.0
#23 66.90   Depends on vulnerable versions of sanitize-html
#23 66.90   node_modules/docstrap
#23 66.90 
#23 66.90 taffydb  *
#23 66.90 Severity: high
#23 66.90 TaffyDB can allow access to any data items in the DB
#23 66.90 fix available via `npm audit fix`
#23 66.90 node_modules/taffydb
#23 66.90 
#23 66.90 underscore  1.3.2 - 1.12.0
#23 66.90 Severity: critical
#23 66.90 Arbitrary Code Execution in underscore
#23 66.90 fix available via `npm audit fix`
#23 66.90 node_modules/jsdoc3/node_modules/underscore
#23 66.90 node_modules/nomnom/node_modules/underscore
#23 66.90   nomnom  >=1.6.0
#23 66.90   Depends on vulnerable versions of underscore
#23 66.90   node_modules/nomnom
#23 66.90 
#23 66.90 11 vulnerabilities (2 low, 2 moderate, 4 high, 3 critical)
#23 66.90 
#23 66.90 To address all issues, run:
#23 66.90   npm audit fix
#23 ERROR: process "/bin/sh -c npm -i install && npm audit fix --force && npm run build && rm -rf node_modules && npm install --production" did not complete successfully: exit code: 1

原因分析 #

1. npm版本与审计机制差异：Node.js 16配套的npm版本（通常为npm 8+）对漏洞的检测和修复逻辑比Node.js 14配套的npm 6更严格，强制修复（--force）时更容易触发依赖冲突。
2. 漏洞集中在开发依赖：报错中的漏洞大多来自jsdoc3、marked、sanitize-html这类开发依赖，它们仅在构建阶段用到，最终生产镜像会删除这些依赖并重新安装生产依赖，原本没必要对这些开发依赖执行审计修复。
3. 构建流程逻辑冗余：原命令先安装全量依赖、强制修复漏洞，再构建、删除依赖、装生产依赖——这个流程里，对开发依赖的修复完全是无用功，反而因为旧开发依赖与Node16不兼容，导致npm audit fix --force失败。

解决方案 #

方案1：调整构建流程，跳过开发依赖的审计修复 #

直接简化构建步骤，不对开发依赖做审计修复，因为它们不会进入最终生产镜像：

FROM node:16-buster-slim

# 安装全量依赖（含开发依赖）用于构建
RUN npm install
# 执行构建
RUN npm run build
# 删除所有依赖，仅安装生产依赖
RUN rm -rf node_modules && npm install --production

如果一定要对生产依赖做漏洞修复，可调整为：

FROM node:16-buster-slim

RUN npm install
RUN npm run build
RUN rm -rf node_modules
# 安装生产依赖后，仅对生产依赖执行审计修复
RUN npm install --production && npm audit fix --only=production

方案2：更新开发依赖版本 #

检查package.json中的开发依赖，将jsdoc3、ink-docstrap等依赖更新到支持Node.js 16的版本，避免拉取存在漏洞且不兼容的旧版本。

方案3：使用官方Node-RED镜像 #

官方Node-RED镜像已经预先处理好Node版本兼容和依赖问题，直接基于它构建更省心：

FROM nodered/node-red:2.2.3-16
# 在这里添加自定义节点、配置等操作

内容的提问来源于stack exchange，提问作者Alcatraz