# Trivy v0.76.2 — Release & Upgrade Intelligence
- **Product:** Trivy (https://trivy.dev)
- **Version:** v0.76.2
- **Released:** Nov 05, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/trivy/updates/v0.76.2/

## Executive Summary (TL;DR)
Trivy v0.76.2 delivers critical security patches by updating underlying container images to Alpine 3.24.3 and bumping key dependencies including golang.org/x/net and go-jose. Users should upgrade promptly to mitigate vulnerabilities related to libcurl, musl, and Go-based networking components.

## Improvements
- Rebuilt container images on Alpine 3.24.3

## Bug Fixes
- Resolved CVE-2026-107891 (musl/musl-utils)
- Fixed libcurl vulnerabilities including high-severity CVE-2026-92392
- Resolved CVE-2026-111497 (brotli-libs)
- Patched vulnerabilities in golang.org/x/net/html (CVE-2026-78661, CVE-2026-97045)
- Fixed GHSA-mgcc-cww5-fp2q in github.com/go-jose/go-jose/v4