Skip to content
OpenAdvisories
High RHSA-2026:50826 10 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 6, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.1-0.5.2.hum1

Vulnerabilities 10

  • High 7.7
    CVE-2026-69192

    ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all deco…

    beaugunderson ip-address langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-69152

    brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing a…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Ubuntu Azure Linux Wolfi npm
  • Medium 6.9
    CVE-2026-67315

    axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

    axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-69198

    ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is short…

    beaugunderson ip-address langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67313

    axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

    axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the Ja…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67314

    axios before 1.18.0 Prototype Pollution via auth subfields

    axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and …

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67316

    axios before 1.18.0 Prototype Pollution via bodyless methods

    axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67317

    axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream

    axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause unc…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-67318

    axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2

    axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-69153

    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by suppl…

    postcss postcss langfuse-3-worker renovate Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-67313
  • report
    https://access.redhat.com/security/cve/CVE-2026-67314
  • report
    https://access.redhat.com/security/cve/CVE-2026-67315
  • report
    https://access.redhat.com/security/cve/CVE-2026-67316
  • report
    https://access.redhat.com/security/cve/CVE-2026-67317
  • report
    https://access.redhat.com/security/cve/CVE-2026-67318
  • report
    https://access.redhat.com/security/cve/CVE-2026-69152
  • report
    https://access.redhat.com/security/cve/CVE-2026-69153
  • report
    https://access.redhat.com/security/cve/CVE-2026-69192
  • report
    https://access.redhat.com/security/cve/CVE-2026-69198
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50826.json
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67313
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510030
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67314
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67314
  • article
    https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g
  • article
    https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510019
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67315
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67315
  • article
    https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548
  • article
    https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510009
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67316
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67316
  • article
    https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx
  • article
    https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510031
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67317
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67317
  • article
    https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9
  • article
    https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2509989
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67318
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67318
  • article
    https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698
  • article
    https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2