Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26 | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-bin | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-devel | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-docs | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-full-i18n | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-libs | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-npm | 1:11.17.0-1.26.4.0.1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | nodejs26-npm-bin | 1:26.4.0-1.4.hum1 |
| Red Hat · Hardened Images 1 hummingbird:1 | v8-14.6-devel | 3:14.6.202.34-1.26.4.0.1.4.hum1 |
Vulnerabilities 1
-
High 7.5
js-yaml: YAML merge-key chains can force quadratic CPU consumption
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-59869
-
article
https://access.redhat.com/security/updates/classification/
-
article
https://images.redhat.com/
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37532.json
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2498122
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-59869
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-59869
-
article
https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
-
article
https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
-
article
https://github.com/nodeca/js-yaml/releases/tag/3.15.0
-
article
https://github.com/nodeca/js-yaml/releases/tag/4.3.0
-
article
https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m