Skip to content
OpenAdvisories
High RHSA-2026:74871 12 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Oct 3, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.12-0.3.hum1

Vulnerabilities 12

  • High 8.3
    CVE-2026-101909

    Axios: Prototype Pollution Gadget in axios toFormData Options

    Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process proto…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-101901

    Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and …

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-101903

    Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL cont…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-101906

    Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 7.6
    CVE-2026-101905

    Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-93450

    go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

    go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services acce…

    go-openapi swag kubevirt kubevirt-openvmm Azure Linux
  • High 7.0
    CVE-2026-101898

    Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 7.0
    CVE-2026-101907

    Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response.…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-101900

    Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw …

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-101902

    Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

    Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same …

    axios axios langfuse-3-worker prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.9
    CVE-2026-101904

    Axios: Header Injection via Inherited headers After Minimal Interceptor

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw se…

    axios axios langfuse-3-worker prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.9
    CVE-2026-101908

    Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

    Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution f…

    axios axios langfuse-3-worker prism Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-101903
  • report
    https://access.redhat.com/security/cve/CVE-2026-93450
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-101905
  • report
    https://access.redhat.com/security/cve/CVE-2026-101901
  • report
    https://access.redhat.com/security/cve/CVE-2026-101904
  • report
    https://access.redhat.com/security/cve/CVE-2026-101902
  • report
    https://access.redhat.com/security/cve/CVE-2026-101906
  • report
    https://access.redhat.com/security/cve/CVE-2026-101898
  • report
    https://access.redhat.com/security/cve/CVE-2026-101907
  • report
    https://access.redhat.com/security/cve/CVE-2026-101909
  • report
    https://access.redhat.com/security/cve/CVE-2026-101908
  • report
    https://access.redhat.com/security/cve/CVE-2026-101900
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74871.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2538979
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-93450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-93450
  • article
    https://github.com/go-openapi/swag
  • article
    https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68
  • article
    https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214
  • article
    https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e
  • article
    https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
  • article
    https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542571
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-101898
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-101898
  • article
    https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
  • article
    https://github.com/axios/axios/pull/11141
  • article
    https://github.com/axios/axios/releases/tag/v1.20.0
  • article
    https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542576
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-101900
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-101900
  • article
    https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542577
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-101901
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-101901
  • article
    https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8