Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 8

Vulnerabilities 15

• High 8.2
  CVE-2026-123863

  A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TL…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Nov 11, 2026
• High 8.1
  CVE-2026-123864

  A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, includin…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• High 8.1
  CVE-2026-123872

  A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiat…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• High 7.5
  CVE-2026-123865

  An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a …

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• High 7.5
  CVE-2026-123866

  A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connection…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• High 7.5
  CVE-2026-123874

  A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• High 7.5
  CVE-2026-126051

  A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Medium 6.8
  CVE-2026-123877

  A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be r…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Medium 6.2
  CVE-2026-123871

  Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Medium 5.9
  CVE-2026-123828

  A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt proc…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Medium 5.9
  CVE-2026-123868

  An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream i…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Medium 5.9
  CVE-2026-123875

  A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and clearte…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Medium 4.2
  CVE-2026-123867

  Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA

  A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, {…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Low 2.9
  CVE-2026-123862

  An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is b…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026
• Low 2.5
  CVE-2026-123829

  A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process i…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Nov 11, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-123872
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-126051
• report
  https://access.redhat.com/security/cve/CVE-2026-123877
• report
  https://access.redhat.com/security/cve/CVE-2026-123874
• report
  https://access.redhat.com/security/cve/CVE-2026-123868
• report
  https://access.redhat.com/security/cve/CVE-2026-123864
• report
  https://access.redhat.com/security/cve/CVE-2026-123875
• report
  https://access.redhat.com/security/cve/CVE-2026-123866
• report
  https://access.redhat.com/security/cve/CVE-2026-123863
• report
  https://access.redhat.com/security/cve/CVE-2026-123871
• report
  https://access.redhat.com/security/cve/CVE-2026-123867
• report
  https://access.redhat.com/security/cve/CVE-2026-123865
• report
  https://access.redhat.com/security/cve/CVE-2026-123829
• report
  https://access.redhat.com/security/cve/CVE-2026-123862
• report
  https://access.redhat.com/security/cve/CVE-2026-123828
• article
  https://access.redhat.com/security/cve/CVE-2026-120423
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99435.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2571813
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-123828
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-123828
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2571829
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-123829
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-123829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2571814
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-123862
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-123862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2571842
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-123863
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-123863
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2571836
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-123864
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-123864
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2571831
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-123865
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-123865