Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 8

Vulnerabilities 21

• High 7.7
  CVE-2026-48618

  A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• High 7.5
  CVE-2026-48933

  A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• High 7.5
  CVE-2026-59870

  js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

  js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consum…

  nodeca js-yaml renovate js-yaml Ubuntu Wolfi npm
  Jul 8, 2026
• High 7.5
  CVE-2026-6734

  undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

  Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless …

  undici undici renovate code-server Debian Ubuntu Wolfi npm
  Jun 17, 2026
• High 7.5
  CVE-2026-9675

  undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

  Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages. A malicious WebSocket server can stream many small fragments that each pass per-frame validation but collective…

  undici undici node-undici undici Ubuntu npm
  Jun 17, 2026
• High 7.4
  CVE-2026-9697

  undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

  Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert…

  undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  Jun 17, 2026
• High 7.1
  CVE-2025-55130 Public exploit

  A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• High 7.1
  CVE-2025-55131

  A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• Medium 6.5
  CVE-2025-59464

  A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freei…

  Node.js node nodejs nodejs-20 Ubuntu Wolfi
  Jan 20, 2026
• Medium 6.5
  CVE-2026-2950

  lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

  The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties…

  lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  Mar 31, 2026
• Medium 6.5
  CVE-2026-45149

  brace-expansion: Large numeric range defeats documented `max` DoS protection

  The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

  juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  May 29, 2026
• Medium 5.9
  CVE-2026-48615

  A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.9
  CVE-2026-9678

  undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

  Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The p…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Jun 17, 2026
• Medium 5.6
  CVE-2026-48930

  A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-48619

  A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-59868

  js-yaml: YAML merge-key chains can force quadratic CPU consumption

  js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

  nodeca js-yaml js-yaml node-js-yaml Ubuntu npm
  Jul 8, 2026
• Medium 4.3
  CVE-2026-48934

  A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 4.2
  CVE-2026-48928

  A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48935

  A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48936

  A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…

  Node.js node nodejs Ubuntu
  Jun 26, 2026
• Low 2.8
  CVE-2025-55132

  A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` e…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2025-59464
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2025-55132
• report
  https://access.redhat.com/security/cve/CVE-2025-55131
• report
  https://access.redhat.com/security/cve/CVE-2025-55130
• report
  https://access.redhat.com/security/cve/CVE-2026-2950
• report
  https://access.redhat.com/security/cve/CVE-2026-45149
• report
  https://access.redhat.com/security/cve/CVE-2026-9697
• report
  https://access.redhat.com/security/cve/CVE-2026-6734
• report
  https://access.redhat.com/security/cve/CVE-2026-9675
• report
  https://access.redhat.com/security/cve/CVE-2026-9678
• report
  https://access.redhat.com/security/cve/CVE-2026-48618
• report
  https://access.redhat.com/security/cve/CVE-2026-48933
• report
  https://access.redhat.com/security/cve/CVE-2026-48615
• report
  https://access.redhat.com/security/cve/CVE-2026-48936
• report
  https://access.redhat.com/security/cve/CVE-2026-48934
• report
  https://access.redhat.com/security/cve/CVE-2026-48928
• report
  https://access.redhat.com/security/cve/CVE-2026-48930
• report
  https://access.redhat.com/security/cve/CVE-2026-48619
• report
  https://access.redhat.com/security/cve/CVE-2026-48935
• report
  https://access.redhat.com/security/cve/CVE-2026-59870
• report
  https://access.redhat.com/security/cve/CVE-2026-59868
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7378.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431352
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55130
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55130
• article
  https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431350
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55131
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431338
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55132
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431344
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59464
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453499
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-2950