Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
🔗 CVE IDs covered (2)
📋 Description
CVE-2026-14257 — brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
🎯 Affected products5
- Red Hat Hardened Images
- nodejs26-main@aarch64 as a component of Red Hat Hardened Images
- nodejs26-main@noarch as a component of Red Hat Hardened Images
- nodejs26-main@src as a component of Red Hat Hardened Images
- nodejs26-main@x86_64 as a component of Red Hat Hardened Images
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not pass untrusted or user-controlled input to brace-expansion's expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion. Where possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output. As an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage. Workaround: To mitigate this vulnerability, do not pass untrusted input to the expand() function.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:54389
- externalhttps://access.redhat.com/security/cve/CVE-2026-14257
- externalhttps://access.redhat.com/security/cve/CVE-2026-69152
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://images.redhat.com/
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54389.json