Skip to content
OpenAdvisories
High RHSA-2026:88537 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.8-0.4.hum1

Vulnerabilities 5

  • High 8.7
    CVE-2026-114126

    Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load…

    storybookjs storybook storybook @storybook/addon-mcp npm
  • High 8.6
    CVE-2026-114125

    Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insuffici…

    storybookjs storybook langfuse-3-worker storybook Wolfi npm
  • High 8.2
    CVE-2026-111755

    follow-redirects sensitiveHeaders regex escaping can expose credential headers

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whos…

    follow-redirects follow-redirects langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-111756

    follow-redirects array-form headers bypass cross-origin credential stripping

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-d…

    follow-redirects follow-redirects langfuse-3-worker prism Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.9
    CVE-2026-65627

    Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

    Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip…

    potatosalad jose rabbitmq-server jose Debian Ubuntu Azure Linux Hex

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-111755
  • report
    https://access.redhat.com/security/cve/CVE-2026-111756
  • report
    https://access.redhat.com/security/cve/CVE-2026-114125
  • report
    https://access.redhat.com/security/cve/CVE-2026-114126
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-65627
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88537.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2561063
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65627
  • article
    https://cna.erlef.org/cves/CVE-2026-65627.html
  • article
    https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad
  • article
    https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429
  • article
    https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm
  • article
    https://osv.dev/vulnerability/EEF-CVE-2026-65627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2555733
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-111755
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-111755
  • article
    https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8
  • article
    https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1
  • article
    https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2556370
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-111756
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-111756
  • article
    https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff
  • article
    https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2558395
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-114125
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-114125
  • article
    https://github.com/storybookjs/storybook/commit/243c06bf8f1e2f09446c44868ea100261e1374da
  • article
    https://github.com/storybookjs/storybook/commit/3be03ec6f11f4616471cebc3fc65c13e1bf8c178
  • article
    https://github.com/storybookjs/storybook/commit/97513d999910d071c2b36830495dab63e17d9fe0
  • article
    https://github.com/storybookjs/storybook/commit/d9b09e332510a88689c71ecc081bbbc2d072476e
  • article
    https://github.com/storybookjs/storybook/commit/df3fed468c9b4830605f00068c4bc6b7e1e215ed
  • article
    https://github.com/storybookjs/storybook/pull/36726
  • article
    https://github.com/storybookjs/storybook/releases/tag/v10.6.2
  • article
    https://github.com/storybookjs/storybook/releases/tag/v11.0.0-alpha.6
  • article
    https://github.com/storybookjs/storybook/releases/tag/v8.6.19