Skip to content
OpenAdvisories
Medium RHSA-2026:13874 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 16, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nodejs24 0:24.15.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-bin 0:24.15.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-devel 0:24.15.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-docs 0:24.15.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-full-i18n 0:24.15.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-libs 0:24.15.0-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-npm 0:11.12.1-1.24.15.0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs24-npm-bin 0:24.15.0-1.hum1

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-45149

    brace-expansion: Large numeric range defeats documented `max` DoS protection

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

    juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45149
  • article
    https://access.redhat.com/security/updates/classification/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13874.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2483481
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45149
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45149
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2