Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 1

Vulnerabilities 2

• High 7.5
  CVE-2026-84292

  fast-uri vulnerable to authority injection via an unvalidated port in serialize

  fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority de…

  fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  Sep 2, 2026
• High 7.5
  CVE-2026-84394

  fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

  fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a doma…

  fast-uri fast-uri renovate prism Debian Ubuntu Wolfi npm
  Sep 2, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-84292
• report
  https://access.redhat.com/security/cve/CVE-2026-84394
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65617.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527747
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84292
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84292
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527756
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84394
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84394
• article
  https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g