Scan Container on the 16.3.3 image flagged Alpine libcrypto3/libssl3 CVE-2026-14456 and HIGH/CRITICAL in the Node image bundled npm CLI. Next/React/sharp were clean. Prod only runs node server.js, so apk-upgrade openssl 3.5.8 and delete npm/corepack/yarn from the prod stage.