Skip to content
OpenAdvisories
High RHSA-2026:54517 9 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 13, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.3-0.1.1.hum1

Vulnerabilities 9

  • High 7.5
    CVE-2026-16221

    fast-uri vulnerable to host confusion via literal backslash authority delimiter

    Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Nod…

    fast-uri fast-uri langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-73088

    Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untru…

    browserslist browserslist langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-73089

    Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

    Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap,…

    browserslist browserslist langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 6.6
    CVE-2026-45819

    baseline-browser-mapping process termination on invalid input causes denial of service

    baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

    web-platform-dx baseline-browser-mapping langfuse-3-worker jupyter-base-notebook Wolfi npm
  • Medium 6.1
    CVE-2026-65911

    DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

    In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides…

    cure53 DOMPurify node-dompurify node-dompurify Debian Ubuntu
  • Medium 6.1
    CVE-2026-65912

    DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

    DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass …

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Medium 6.1
    CVE-2026-65913

    DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

    DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DO…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-65914

    DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

    DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequ…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Medium 4.7
    CVE-2026-65904

    DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

    DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for f…

    cure53 DOMPurify node-dompurify node-dompurify Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-73088
  • report
    https://access.redhat.com/security/cve/CVE-2026-73089
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45819
  • report
    https://access.redhat.com/security/cve/CVE-2026-16221
  • report
    https://access.redhat.com/security/cve/CVE-2026-65904
  • report
    https://access.redhat.com/security/cve/CVE-2026-65912
  • report
    https://access.redhat.com/security/cve/CVE-2026-65911
  • report
    https://access.redhat.com/security/cve/CVE-2026-65914
  • report
    https://access.redhat.com/security/cve/CVE-2026-65913
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54517.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2502307
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-16221
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-16221
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2515240
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45819
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45819
  • article
    https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142
  • article
    https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
  • article
    https://www.npmjs.com/package/baseline-browser-mapping
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506426
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65904
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65904
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934
  • article
    https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-mode
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506434
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65911
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65911
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75
  • article
    https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506427
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65912
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65912
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r
  • article
    https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506429