25 of 134 components are vulnerable?!

[aboettger]

Can you explain this at least? Transparency is everything.
https://hub.docker.com/r/library/node/tags/7/

[chorrell]

See also:

docker-library/official-images#2740
#219
#195 (comment)

[chorrell]

The TLDR; is that the Docker Hubs reporting of vulnerabilities isn't entirely accurate.

CVE-2014-9761 for instance (as noted in docker-library/official-images/issues/2740) is marked as a "Minor issue" by the Debian Security team. See https://security-tracker.debian.org/tracker/CVE-2014-9761

CVE-2016-5180 was patched directly in node with nodejs/node#8849