Skip to content
OpenAdvisories
High RHSA-2026:54520 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 prometheus3.5 0:3.5.5-0.8.hum1

Vulnerabilities 2

  • High 7.5
    CVE-2026-73646

    PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), …

    postcss postcss langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-73086

    nanoid: Integer Overflow or Wraparound

    nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 21…

    ai nanoid jupyter-base-notebook node-postcss Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-73086
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-73646
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54520.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2514175
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-73086
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-73086
  • article
    https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
  • article
    https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
  • article
    https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
  • article
    https://github.com/ai/nanoid/releases/tag/3.3.12
  • article
    https://github.com/ai/nanoid/releases/tag/5.1.11
  • article
    https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2517456
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-73646
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-73646
  • article
    https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c
  • article
    https://github.com/postcss/postcss/releases/tag/8.5.18
  • article
    https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849