Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 8

Vulnerabilities 15

• High 7.5
  CVE-2026-56846 Public exploit

  A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• High 7.5
  CVE-2026-58043 Public exploit

  A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• High 7.4
  CVE-2026-13697

  undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

  undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be sto…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Jul 29, 2026
• Medium 6.3
  CVE-2026-58040 Public exploit

  An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Medium 6.2
  CVE-2026-58045 Public exploit

  A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 5.9
  CVE-2026-14643

  undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

  undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directi…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Jul 29, 2026
• Medium 5.9
  CVE-2026-58042 Public exploit

  A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 5.3
  CVE-2026-58041 Public exploit

  A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 4.8
  CVE-2026-16728

  undici vulnerable to downstream response desynchronization via retry interceptor

  undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up t…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Jul 29, 2026
• Medium 4.8
  CVE-2026-16729

  undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

  undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized…

  undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  Jul 29, 2026
• Medium 4.2
  CVE-2026-15157

  undici vulnerable to CRLF Injection via blob-like body 'type' property

  undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application…

  undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  Jul 29, 2026
• Medium 4.1
  CVE-2026-56850 Public exploit

  A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Low 3.7
  CVE-2026-58044 Public exploit

  A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Low 3.3
  CVE-2026-56847 Public exploit

  A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Low 3.3
  CVE-2026-58039 Public exploit

  A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-58043
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-56847
• report
  https://access.redhat.com/security/cve/CVE-2026-56850
• report
  https://access.redhat.com/security/cve/CVE-2026-58040
• report
  https://access.redhat.com/security/cve/CVE-2026-16729
• report
  https://access.redhat.com/security/cve/CVE-2026-13697
• report
  https://access.redhat.com/security/cve/CVE-2026-15157
• report
  https://access.redhat.com/security/cve/CVE-2026-14643
• report
  https://access.redhat.com/security/cve/CVE-2026-16728
• report
  https://access.redhat.com/security/cve/CVE-2026-58039
• report
  https://access.redhat.com/security/cve/CVE-2026-56846
• report
  https://access.redhat.com/security/cve/CVE-2026-58044
• report
  https://access.redhat.com/security/cve/CVE-2026-58042
• report
  https://access.redhat.com/security/cve/CVE-2026-58041
• report
  https://access.redhat.com/security/cve/CVE-2026-58045
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48537.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508485
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13697
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508676
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-14643
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-14643
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508677
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15157
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15157
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508678
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-16728
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-16728
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508506
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-16729
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-16729
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm