RHSA-2026:48126HighCVSS 8.1

Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.

Published
July 29, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (12)

CVE-2026-13676 →CVE-2026-46625 →CVE-2026-48069 →CVE-2026-48801 →CVE-2026-49978 →CVE-2026-5079 →CVE-2026-45740 →CVE-2026-48068 →CVE-2026-59869 →CVE-2026-59877 →CVE-2026-5038 →CVE-2026-13149 →

📋 Description

CVE-2026-5038 — multer: Multer: Denial of Service via aborted or malformed multipart uploads CVE-2026-5079 — multer: Multer: Denial of Service via deeply nested field names in multipart form data CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-45740 — protobufjs: protobufjs: Denial of Service via crafted JSON descriptors CVE-2026-46625 — js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-48069 — grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-49978 — dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema

🎯 Affected products8

  • Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64 as a component of Red Hat Developer Hub 1.10
  • registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64 as a component of Red Hat Developer Hub 1.10

✅ Remediation

For more about Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To reduce the impact of this denial of service vulnerability, configure the `limits.fields` option within your `multer` instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service. Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.

🔗 References (31)