Skip to content
OpenAdvisories
High RHSA-2026:37534 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Jul 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nodejs25 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-bin 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-devel 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-docs 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-full-i18n 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-libs 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-npm 1:11.12.1-1.25.9.0.1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs25-npm-bin 1:25.9.0-1.3.hum1
Red Hat · Hardened Images 1 hummingbird:1 v8-14.1-devel 3:14.1.146.11-1.25.9.0.1.3.hum1

Vulnerabilities 2

  • High 7.5
    CVE-2026-59869

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml katib-suggestion-hyperopt prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 5.3
    CVE-2026-53550

    js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases

    js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic pa…

    nodeca js-yaml langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-59869
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-53550
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37534.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491401
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-53550
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-53550
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498122
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59869
  • article
    https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
  • article
    https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
  • article
    https://github.com/nodeca/js-yaml/releases/tag/3.15.0
  • article
    https://github.com/nodeca/js-yaml/releases/tag/4.3.0
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m