Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 8

Vulnerabilities 14

• High 7.7
  CVE-2026-48618

  A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• High 7.5
  CVE-2026-48933

  A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• High 7.5
  CVE-2026-59870

  js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

  js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consum…

  nodeca js-yaml renovate js-yaml Ubuntu Wolfi npm
  Jul 8, 2026
• Medium 6.5
  CVE-2026-2950

  lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

  The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties…

  lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm
  Mar 31, 2026
• Medium 6.5
  CVE-2026-45149

  brace-expansion: Large numeric range defeats documented `max` DoS protection

  The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

  juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  May 29, 2026
• Medium 5.9
  CVE-2026-48615

  A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.6
  CVE-2026-48930

  A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-48619

  A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-59868

  js-yaml: YAML merge-key chains can force quadratic CPU consumption

  js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the…

  nodeca js-yaml js-yaml node-js-yaml Ubuntu npm
  Jul 8, 2026
• Medium 5.3
  CVE-2026-8723

  qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly

  ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strict…

  ljharb qs langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  May 16, 2026
• Medium 4.3
  CVE-2026-48934

  A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 4.2
  CVE-2026-48928

  A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48935

  A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48936

  A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…

  Node.js node nodejs Ubuntu
  Jun 26, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-2950
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-45149
• report
  https://access.redhat.com/security/cve/CVE-2026-8723
• report
  https://access.redhat.com/security/cve/CVE-2026-48618
• report
  https://access.redhat.com/security/cve/CVE-2026-48933
• report
  https://access.redhat.com/security/cve/CVE-2026-48615
• report
  https://access.redhat.com/security/cve/CVE-2026-48936
• report
  https://access.redhat.com/security/cve/CVE-2026-48934
• report
  https://access.redhat.com/security/cve/CVE-2026-48928
• report
  https://access.redhat.com/security/cve/CVE-2026-48930
• report
  https://access.redhat.com/security/cve/CVE-2026-48619
• report
  https://access.redhat.com/security/cve/CVE-2026-48935
• report
  https://access.redhat.com/security/cve/CVE-2026-59870
• report
  https://access.redhat.com/security/cve/CVE-2026-59868
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9455.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453499
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-2950
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-2950
• article
  https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2478227
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-8723
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-8723
• article
  https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41
• article
  https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2483481
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45149
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45149
• article
  https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493335
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48615
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48615
• article
  https://nodejs.org/en/blog/vulnerability/june-2026-security-releases
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493337
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48618
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-48618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48619