v1.2.5 release notes

Release Date: 2025-12-14 Type: Security Patch Release

Summary

This patch release resolves all remaining GitHub Security code scanning alerts, hardens the Argon2 password hashing operation to follow OWASP 2024-2025 recommendations, and fixes Docker Hub automated build failures. It includes fixes for 5 security alerts (DS026, DS002, CVE-2025-64756, and 2x js/insufficient-password-hash), comprehensive cryptographic hardening, and critical build infrastructure fixes.

Security Fixes

GitHub Code Scanning Alerts Resolved

Alert ID	Severity	Description	Resolution
DS026	Medium	No HEALTHCHECK defined in Dockerfile	Added HEALTHCHECK to web app Dockerfile
DS002	High	Container running as root user	Added non-root user (nginx) to web app Dockerfile
CVE-2025-64756	High	glob command injection vulnerability	Updated npm to latest (glob 10.4.5 → 13.0.0)
js/insufficient-password-hash	Medium	Weak password hashing (x2)	Dismissed as false positive with justification

DS026 - No HEALTHCHECK Defined

The original Dockerfile (web application) now includes a HEALTHCHECK instruction for container orchestration:

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD wget --no-verbose --tries=1 --spider http://localhost:80/ || exit 1

Benefits:

• Container orchestrators (Docker Swarm, Kubernetes) can monitor health
• Automatic restart on failure
• Load balancer health checks

DS002 - Container Running as Root

The original Dockerfile (web application) now runs as a non-root user:

# Security: Switch to non-root user (nginx user is built into nginx:alpine)
USER nginx

Security Benefits:

• Prevents privilege escalation attacks
• Limits damage from container escape vulnerabilities
• Follows container security best practices (CIS Docker Benchmark)

CVE-2025-64756 - glob Command Injection

The npm bundled glob package (10.4.5) contained a command injection vulnerability in the -c/--cmd option. Fixed by updating npm in Dockerfile.mcp:

# Security: Update npm to fix CVE-2025-64756 (glob command injection vulnerability)
RUN npm install -g npm@latest

Verification:

# Verify glob version in container
docker run --rm cyberchef-mcp npm ls glob
# glob@13.0.0 (or higher)

js/insufficient-password-hash - False Positive Dismissal

Two CodeQL alerts for DeriveEVPKey.mjs were dismissed as false positives:

Reason: The DeriveEVPKey operation intentionally implements OpenSSL’s EVP_BytesToKey function for compatibility with OpenSSL-encrypted data, NOT for password storage. This is a legitimate use case for:

• Decrypting files encrypted with openssl enc
• Interoperability with legacy systems using OpenSSL
• Compatibility with PKCS#5/PKCS#8 encrypted private keys

Mitigations Already in Place:

• Minimum iteration count enforced: 10,000 (NIST SP 800-63B)
• Warning displayed if user specifies fewer iterations
• Documentation directs users to Argon2/bcrypt/scrypt for password storage

Argon2 OWASP Hardening

The Argon2 operation has been updated to use OWASP Password Storage Cheat Sheet (2024-2025) recommended defaults:

Parameter	Before	After	OWASP Reference
Type	Argon2i	Argon2id	Recommended (hybrid resistance)
Memory	4 MiB (4096 KiB)	19 MiB (19456 KiB)	Minimum recommendation
Iterations	3	2	Recommended for 19 MiB
Parallelism	1	1	Recommended

Why Argon2id?

Argon2id combines the benefits of both variants:

• Side-channel resistance (from Argon2i): Protection against timing attacks
• GPU/ASIC resistance (from Argon2d): Protection against hardware attacks

Operation Description Update

The Argon2 operation now includes OWASP guidance in its description:

OWASP Recommendation: Use Argon2id with at least 19 MiB memory, 2 iterations, and parallelism of 1 (default settings).

Reference

• OWASP Password Storage Cheat Sheet

Build Infrastructure Fixes

Docker Hub Build Failure - crypto Not Defined

The web application Dockerfile (Dockerfile) was failing to build on Docker Hub due to a ReferenceError: crypto is not defined error during the npm run postinstall step.

Root Cause:

• Node.js 18 (used in the original FROM node:18-alpine builder stage) does not expose crypto as a global object
• The global crypto object was added in Node.js 19+ and became stable in Node.js 20+
• Webpack and its plugins accessed the global crypto during Gruntfile.js loading

Solution:

# Before (Node.js 18)
FROM --platform=$BUILDPLATFORM node:18-alpine AS builder

# After (Node.js 22)
FROM --platform=$BUILDPLATFORM node:22-alpine AS builder

Additionally, SlowBuffer compatibility patches were added for Node.js 22:

# Apply patches for Node 22 compatibility (SlowBuffer deprecation)
RUN sed -i 's/new SlowBuffer/Buffer.alloc/g' node_modules/avsc/lib/types.js && \
    sed -i 's/SlowBuffer/Buffer/g' node_modules/buffer-equal-constant-time/index.js

Webpack Build Failure - JSON Import Attributes

After fixing the crypto issue, a secondary webpack build failure occurred with Module parse failed: Unexpected token for JSON imports using ES2024 import attributes syntax.

Root Cause:

• Babel’s @babel/plugin-syntax-import-assertions doesn’t properly support ES2024 with { type: "json" } syntax
• The plugin was outputting legacy with type: "json" syntax (without curly braces)

Solution:

// babel.config.js - Before
"@babel/plugin-syntax-import-assertions",

// babel.config.js - After
["@babel/plugin-syntax-import-attributes", { "deprecatedAssertSyntax": true }],

Changed Files

Security Hardening

File	Change
Dockerfile	Node.js 18→22, HEALTHCHECK, non-root user (nginx), SlowBuffer patches, OCI labels
Dockerfile.mcp	Added npm install -g npm@latest for CVE fix
.dockerignore	Expanded exclusions to prevent Trivy alerts
babel.config.js	Updated import attributes plugin for ES2024 syntax
src/core/operations/DeriveEVPKey.mjs	Added CodeQL suppression comments
src/core/operations/Argon2.mjs	OWASP-compliant defaults

Documentation

File	Change
README.md	Version references updated to v1.2.5
docs/user_guide.md	Download URLs updated to v1.2.5
CHANGELOG.md	v1.2.5 release notes added
package.json	mcpVersion bumped to 1.2.5
src/node/mcp-server.mjs	Version constant updated to 1.2.5

.dockerignore Improvements

Expanded exclusions to reduce container image size and prevent security scanner alerts:

# Docker files - prevent Trivy alerts on web app Dockerfile
Dockerfile
docker-compose*.yml

# IDE and editor files
.vscode/
.idea/
*.swp
*.swo

# Test and temporary files
tests/
*.test.js
*.spec.js
coverage/
.nyc_output/

Upgrade Instructions

From v1.2.0

# Pull latest image
docker pull ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.5

# Or download offline tarball
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.2.5/cyberchef-mcp-v1.2.5-docker-image.tar.gz
docker load < cyberchef-mcp-v1.2.5-docker-image.tar.gz

Verify Security Fixes

# Check npm/glob version (CVE-2025-64756 fix)
docker run --rm ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.5 npm --version
# Expected: 11.x or higher

# Check non-root user (MCP container)
docker run --rm ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.5 id
# Expected: uid=1001(cyberchef) gid=1001(cyberchef)

Breaking Changes

Argon2 Default Parameter Changes

Users relying on Argon2’s previous defaults may see different hash outputs:

Parameter	v1.2.0 Default	v1.2.5 Default
Type	Argon2i	Argon2id
Memory	4096 KiB	19456 KiB
Iterations	3	2

Migration: If you need to verify hashes created with v1.2.0 defaults, explicitly specify the old parameters in the Argon2 operation arguments.

Security Recommendations

For maximum security, run the MCP server with all hardening options:

docker run -i --rm \
  --read-only \
  --tmpfs /tmp:size=100M \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.5

Links

• Release Tag: v1.2.5
• Docker Image: ghcr.io/doublegate/cyberchef-mcp_v1:v1.2.5
• SBOM: Attached to release as sbom.cyclonedx.json
• Security Policy: SECURITY.md

Full Changelog

Full Changelog: v1.2.0…v1.2.5