Skip to content
OpenAdvisories
High RHSA-2026:47619 6 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 30, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.6-0.2.hum1

Vulnerabilities 6

  • High 8.3
    CVE-2026-67320

    axios before 0.33.0 Prototype Pollution via Node HTTP adapter

    axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable inte…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-42127

    Pre-authentication denial of service in the public dashboard query endpoint

    The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exh…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Ubuntu Alpine Wolfi Go
  • Medium 6.9
    CVE-2026-67321

    axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

    axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested values passed to axios form or par…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67312

    axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON

    axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passe…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-67213

    nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

    nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the…

    nanoid_project nanoid langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Low 3.7
    CVE-2026-56764

    Hono - Timing Attack in basicAuth and bearerAuth Middleware

    Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid…

    Hono Hono hono npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-56764
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67213
  • report
    https://access.redhat.com/security/cve/CVE-2026-42127
  • report
    https://access.redhat.com/security/cve/CVE-2026-67321
  • report
    https://access.redhat.com/security/cve/CVE-2026-67312
  • report
    https://access.redhat.com/security/cve/CVE-2026-67320
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47619.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2491449
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42127
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42127
  • article
    https://grafana.com/security/security-advisories/cve-2026-42127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500893
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-56764
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-56764
  • article
    https://github.com/honojs/hono/security/advisories/GHSA-gq3j-xvxp-8hrf
  • article
    https://www.vulncheck.com/advisories/hono-timing-attack-in-basicauth-and-bearerauth-middleware
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2508406
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67213
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67213
  • article
    https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
  • article
    https://github.com/ai/nanoid/releases/tag/5.1.6
  • article
    https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510007
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67312
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67312
  • article
    https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72
  • article
    https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509993
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67320
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67320
  • article
    https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc
  • article
    https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9
  • article
    https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510011
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67321
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67321
  • article
    https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23