diff --git a/Dockerfile b/Dockerfile
index bb81977b..e7f62c72 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,10 @@ LABEL org.opencontainers.image.vendor="root.cloud"
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN addgroup --system --gid 1001 nodejs && \
+RUN apk upgrade --no-cache && \
+    npm uninstall -g npm && \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npx && \
+    addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
diff --git a/ROADMAP.md b/ROADMAP.md
index 1aeb3526..903f3a60 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -232,6 +232,7 @@ This document tracks the development status and planned features for JMAP Webmai
 - [x] Structured server-side logger (text/JSON format, configurable level)
 - [x] Pre-built Docker image on [Docker Hub](https://hub.docker.com/r/rootfr/jmap-webmail) and [GHCR](https://ghcr.io/root-fr/jmap-webmail) with multi-arch support (amd64/arm64)
 - [x] GitHub Actions CI/CD for automated image publishing on releases
+- [x] CVE remediation: remove npm from production image, upgrade Alpine packages
 
 ## Planned Features