fix: install nginx from official repo to fix CVE-2026-42945 (CVSS 9.2 RCE)

[zethis]

What

Add the official nginx mainline Alpine package repository and install nginx from it instead of the Alpine 3.21 default repo.

+RUN echo "@nginx https://packages.nginx.org/mainline/alpine/v3.21/main" >> /etc/apk/repositories \
+  && wget -qO /etc/apk/keys/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \
+  && apk --update --no-cache add nginx@nginx
+
 RUN apk --update --no-cache add \
     7zip \
     ...
-    nginx \

Why

Alpine 3.21 ships nginx 1.26.3 via its default apk repos, which is vulnerable to CVE-2026-42945 (CVSS v4 9.2 Critical): a heap buffer overflow in ngx_http_rewrite_module allowing unauthenticated RCE on systems with ASLR disabled. A public PoC has been available since 2026-05-13.

The official nginx Alpine repository (packages.nginx.org) provides nginx 1.31.0 which includes the fix.

• Affected: nginx 0.6.27 – 1.30.0
• Fixed in: nginx 1.30.1, 1.31.0
• Advisory: nginx security advisories · F5 K000161019 · CVE-2026-42945