Skip to content
OpenAdvisories
High RHSA-2026:38304 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Jul 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nodejs22 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-bin 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-devel 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-docs 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-full-i18n 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-libs 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-npm 1:10.9.8-1.22.23.1.2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nodejs22-npm-bin 1:22.23.1-2.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 v8-12.4-devel 3:12.4.254.21-1.22.23.1.2.1.hum1

Vulnerabilities 1

  • High 7.5
    CVE-2026-59869

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml katib-suggestion-hyperopt prism Debian Ubuntu Azure Linux Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-59869
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38304.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498122
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59869
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59869
  • article
    https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
  • article
    https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
  • article
    https://github.com/nodeca/js-yaml/releases/tag/3.15.0
  • article
    https://github.com/nodeca/js-yaml/releases/tag/4.3.0
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m