Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 8

Vulnerabilities 2

• Low 3.7
  CVE-2026-11525

  undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

  Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the th…

  undici undici renovate prism Debian Ubuntu Azure Linux Wolfi npm
  Jun 17, 2026
• Low 1.8
  CVE-2026-48617

  A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. Thi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 18, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-11525
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-48617
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45783.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490008
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-11525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-11525
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490521
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48617
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48617
• article
  http://hackerone.com/reports/3692858
• article
  https://nodejs.org/en/blog/vulnerability/june-2026-security-releases