diff --git a/.changeset/patch-refresh-gh-aw-node.md b/.changeset/patch-refresh-gh-aw-node.md
index bab86bbfc78..22c07828436 100644
--- a/.changeset/patch-refresh-gh-aw-node.md
+++ b/.changeset/patch-refresh-gh-aw-node.md
@@ -2,4 +2,4 @@
 "gh-aw": patch
 ---
 
-Refresh the `gh-aw-node` image's Alpine and npm packages and publish it for both amd64 and arm64.
+Refresh the `gh-aw-node` image's Alpine and npm packages and publish it for both amd64 and arm64. Bump npm to 11.19.0 and patch bundled `tar` to ≥7.5.22 and `brace-expansion` to ≥5.0.8 to address container security findings (CVE-2026-58055, CVE-2025-60876, and related npm dependency vulnerabilities).
diff --git a/actions/setup/js/Dockerfile.safe-outputs-mcp b/actions/setup/js/Dockerfile.safe-outputs-mcp
index 81c48834a8e..5b349cb1bca 100644
--- a/actions/setup/js/Dockerfile.safe-outputs-mcp
+++ b/actions/setup/js/Dockerfile.safe-outputs-mcp
@@ -7,13 +7,16 @@ ARG NODE_IMAGE
 ARG NODE_IMAGE_DIGEST=""
 ARG NODE_IMAGE_UPDATED_AT=""
 ARG DOCKERFILE_HASH=""
-ARG NPM_VERSION=11.18.0
+ARG NPM_VERSION=11.19.0
 
 # Intentional: upgrade all packages to pick up security fixes; downstream digest pins the result.
+# After upgrading npm, patch its bundled dependencies to meet minimum safe versions
+# (tar >= 7.5.21 for CVE-2025-tar, brace-expansion >= 5.0.8 for CVE-2025-brace-expansion).
 RUN apk upgrade --no-cache \
     && apk add --no-cache git \
     && apk info -v | sort \
     && npm install --global "npm@${NPM_VERSION}" \
+    && npm install --prefix "$(npm root -g)/npm" --no-save "tar@^7.5.22" "brace-expansion@^5.0.8" \
     && npm cache clean --force
 
 LABEL org.opencontainers.image.source="https://github.com/github/gh-aw" \