Skip to content
OpenAdvisories
High RHSA-2026:63782 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Sep 7, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.9-0.6.hum1

Vulnerabilities 4

  • High 7.5
    CVE-2026-84292

    fast-uri vulnerable to authority injection via an unvalidated port in serialize

    fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority de…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-84394

    fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

    fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a doma…

    fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-85152

    undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

    undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or …

    undici undici node-undici node-undici Debian Ubuntu npm
  • Medium 5.9
    CVE-2026-85024

    undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression

    undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that cross…

    undici undici renovate prism Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-84292
  • report
    https://access.redhat.com/security/cve/CVE-2026-84394
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-85024
  • report
    https://access.redhat.com/security/cve/CVE-2026-85152
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63782.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2527747
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-84292
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-84292
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2527756
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-84394
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-84394
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528707
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-85024
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-85024
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-3wwx-pv8p-q78v
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528717
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-85152
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-85152
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm