Skip to content
OpenAdvisories
Critical RHSA-2026:57590 24 CVEs

Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

Published Aug 21, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 rh-podman-desktop 0:1.1.2-1.el10_2

Vulnerabilities 24

  • Critical 9.2
    CVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-48801

    linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

    linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level sc…

    markdown-it linkify-it opensearch-dashboards-3-dashboards-observability node-markdown-it Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-59874

    node-tar: Negative tar entry size causes infinite loop in archive replace

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2026-56876 Public exploit

    extract-zip unvalidated symlink path traversal

    extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to p…

    max-mapper extract-zip extract-zip node-extract-zip Debian Ubuntu npm
  • High 7.7
    CVE-2026-13149

    brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transit…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.7
    CVE-2026-44705

    tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

    tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By…

    raszi node-tmp katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 7.7
    CVE-2026-69192

    ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all deco…

    beaugunderson ip-address langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-12143

    form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

    form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage …

    form-data form-data langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-13676

    fast-uri vulnerable to host confusion via failed IDN canonicalization

    fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form…

    fast-uri fast-uri prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-14257

    brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace grou…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go
  • High 7.5
    CVE-2026-42570

    Svelte devalue: DoS via sparse array deserialization

    Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate mu…

    sveltejs devalue devalue npm
  • High 7.5
    CVE-2026-45623

    PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to pr…

    postcss postcss langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-48068

    @grpc/grps-js: A malformed request can cause a server crash

    @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-j…

    grpc grpc-node langfuse-3-worker langfuse-3 Wolfi npm
  • High 7.5
    CVE-2026-48779

    ws: Memory exhaustion DoS from tiny fragments and data chunks

    ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer c…

    websockets ws langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-59869

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml katib-suggestion-hyperopt prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-69152

    brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing a…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Ubuntu Azure Linux Wolfi npm
  • Medium 6.3
    CVE-2026-49978

    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event ha…

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-69153

    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by suppl…

    postcss postcss langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2026-42338

    ip-address: XSS in Address6 HTML-emitting methods

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressEr…

    beaugunderson ip-address langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2026-45740

    protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON(). A crafted JSON descripto…

    protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm
  • Medium 5.3
    CVE-2026-59877

    protobufjs: Denial of Service via infinite loop in .proto option parsing

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that o…

    protobufjs protobuf.js kubeflow-centraldashboard jitsucom-jitsu-console Wolfi npm
  • Medium 5.3
    CVE-2026-9595

    webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

    Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend,…

    webpack-dev-server webpack-dev-server katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  • Medium 4.4
    CVE-2026-45736

    ws: Uninitialized memory disclosure

    ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

    websockets ws langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455470
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2476810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477081
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477914
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487050
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487946
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488480
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2488934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489661
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2493633
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494197
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2494813
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498116
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498120
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498122
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498127
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2499682
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500695
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506433
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2507595
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510719
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510722
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2510801
  • article
    https://issues.redhat.com/browse/RHEL-238929
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-9595
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9595
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9595
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/facebook/create-react-app/pull/7444
  • article
    https://github.com/vuejs/vue-cli/commit/72ba7505aff2a8314e82aa5082379a77504a1fcb
  • article
    https://github.com/webpack/webpack-dev-server/pull/4316
  • article
    https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-mx8g-39q3-5c79
  • report
    https://access.redhat.com/security/cve/CVE-2026-12143
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-12143
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-12143
  • article
    https://cwe.mitre.org/data/definitions/93.html