Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 9

Vulnerabilities 10

• High 7.7
  CVE-2026-13149

  brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

  brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transit…

  juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Jun 30, 2026
• High 7.5
  CVE-2026-59870

  js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

  js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consum…

  nodeca js-yaml renovate js-yaml Ubuntu Wolfi npm
  Jul 8, 2026
• Medium 5.6
  CVE-2026-48930

  A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-48619

  A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-53550

  js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

  js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic pa…

  nodeca js-yaml langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Jun 22, 2026
• Medium 5.3
  CVE-2026-59868

  js-yaml: YAML merge-key chains can force quadratic CPU consumption

  js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

  nodeca js-yaml js-yaml node-js-yaml Ubuntu npm
  Jul 8, 2026
• Medium 4.3
  CVE-2026-48934

  A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 4.2
  CVE-2026-48928

  A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48935

  A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48936

  A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…

  Node.js node nodejs Ubuntu
  Jun 26, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-13149
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-53550
• report
  https://access.redhat.com/security/cve/CVE-2026-48936
• report
  https://access.redhat.com/security/cve/CVE-2026-48934
• report
  https://access.redhat.com/security/cve/CVE-2026-48928
• report
  https://access.redhat.com/security/cve/CVE-2026-48930
• report
  https://access.redhat.com/security/cve/CVE-2026-48619
• report
  https://access.redhat.com/security/cve/CVE-2026-48935
• report
  https://access.redhat.com/security/cve/CVE-2026-59870
• report
  https://access.redhat.com/security/cve/CVE-2026-59868
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33866.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2494813
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13149
• article
  https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
• article
  https://www.npmjs.com/package/brace-expansion
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48619
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48619
• article
  https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493333
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48928
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48928
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48930
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48930
• article
  https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e
• article
  https://hackerone.com/reports/3656716
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493332
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48934
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48934
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48935
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493336
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48936
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48936