Skip to content
OpenAdvisories
High RHSA-2026:7655 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published May 4, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 yarnpkg 0:1.22.22-18.1.hum1

Vulnerabilities 5

  • High 7.5
    CVE-2026-59870

    js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

    js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consum…

    nodeca js-yaml renovate js-yaml Ubuntu Wolfi npm
  • Medium 6.5
    CVE-2026-2950

    lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties…

    lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm
  • Medium 6.5
    CVE-2026-45149

    brace-expansion: Large numeric range defeats documented `max` DoS protection

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

    juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2026-59868

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

    nodeca js-yaml js-yaml node-js-yaml Ubuntu npm
  • Medium 4.4
    CVE-2026-45736

    ws: Uninitialized memory disclosure

    ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

    websockets ws langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-2950
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-45149
  • report
    https://access.redhat.com/security/cve/CVE-2026-45736
  • report
    https://access.redhat.com/security/cve/CVE-2026-59870
  • report
    https://access.redhat.com/security/cve/CVE-2026-59868
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7655.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453499
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-2950
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-2950
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2483481
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45149
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45149
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477914
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-45736
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-45736
  • article
    https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086
  • article
    https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498114
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59868
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59868
  • article
    https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
  • article
    https://github.com/nodeca/js-yaml/releases/tag/5.2.0
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2498130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-59870
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-59870
  • article
    https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
  • article
    https://github.com/nodeca/js-yaml/releases/tag/5.2.1
  • article
    https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm