Skip to content
OpenAdvisories
High RHSA-2026:49387 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 4, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.1-0.4.hum1

Vulnerabilities 2

  • High 7.5
    CVE-2026-18446

    fast-uri vulnerable to host confusion via backslash authority introducer

    fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is pa…

    fast-uri fast-uri langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67319

    axios before 0.33.0 Prototype Pollution via nested option objects

    axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null protot…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-18446
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67319
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49387.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509801
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-18446
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-18446
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510023
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67319
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67319
  • article
    https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq
  • article
    https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects