Skip to content
OpenAdvisories
High RHSA-2026:22380 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jun 18, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nodejs26 0:26.3.0-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-bin 0:26.3.0-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-devel 0:26.3.0-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-docs 0:26.3.0-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-full-i18n 0:26.3.0-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-libs 0:26.3.0-1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-npm 0:11.16.0-1.26.3.0.1.2.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs26-npm-bin 0:26.3.0-1.2.hum1

Vulnerabilities 5

  • High 7.5
    CVE-2026-6734

    undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

    Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless …

    undici undici renovate code-server Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-9675

    undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

    Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collective…

    undici undici node-undici undici Ubuntu npm
  • High 7.4
    CVE-2026-9697

    undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

    Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert…

    undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.5
    CVE-2026-45149

    brace-expansion: Large numeric range defeats documented `max` DoS protection

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

    juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-9678

    undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

    Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The p…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45149
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-9697
  • report
    https://access.redhat.com/security/cve/CVE-2026-6734
  • report
    https://access.redhat.com/security/cve/CVE-2026-9675
  • report
    https://access.redhat.com/security/cve/CVE-2026-9678
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22380.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2490024
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6734
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6734
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489979
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9675
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9675
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2490000
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9678
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9678
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2490018
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9697
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9697
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2483481
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45149
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45149
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2