Skip to content
OpenAdvisories
High RHSA-2026:50287 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 5, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 prometheus3.13 0:3.13.2-0.2.hum1

Vulnerabilities 4

  • High 7.5
    CVE-2026-73646

    PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), …

    postcss postcss langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-73086

    nanoid: Integer Overflow or Wraparound

    nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 21…

    ai nanoid jupyter-base-notebook node-postcss Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-72815 Public exploit

    go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

    go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rat…

    go-chi chi golang-github-go-chi-chi golang-github-go-chi-chi Debian Ubuntu Go
  • Medium 6.3
    CVE-2026-69153

    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by suppl…

    postcss postcss langfuse-3-worker renovate Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-69153
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-73086
  • report
    https://access.redhat.com/security/cve/CVE-2026-72815
  • report
    https://access.redhat.com/security/cve/CVE-2026-73646
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50287.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510719
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-69153
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-69153
  • article
    https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
  • article
    https://github.com/postcss/postcss/releases/tag/8.5.19
  • article
    https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2515988
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-72815
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-72815
  • article
    https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx
  • article
    https://www.vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514175
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-73086
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-73086
  • article
    https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
  • article
    https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
  • article
    https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
  • article
    https://github.com/ai/nanoid/releases/tag/3.3.12
  • article
    https://github.com/ai/nanoid/releases/tag/5.1.11
  • article
    https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517456
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-73646
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-73646
  • article
    https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c
  • article
    https://github.com/postcss/postcss/releases/tag/8.5.18
  • article
    https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849