RHSA-2026:9455HighCVSS 7.7
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
🔗 CVE IDs covered (6)
📋 Description
CVE-2026-2950 — lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass CVE-2026-45149 — brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges CVE-2026-48615 — nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling CVE-2026-48618 — nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch CVE-2026-48933 — nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() CVE-2026-48936 — nodejs: Node.js: Local server can be started without network permission via Permission API flaw
🔗 References (11)
- selfhttps://access.redhat.com/errata/RHSA-2026:9455
- externalhttps://images.redhat.com/
- externalhttps://access.redhat.com/security/cve/CVE-2026-2950
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://access.redhat.com/security/cve/CVE-2026-45149
- externalhttps://access.redhat.com/security/cve/CVE-2026-8723
- externalhttps://access.redhat.com/security/cve/CVE-2026-48618
- externalhttps://access.redhat.com/security/cve/CVE-2026-48933
- externalhttps://access.redhat.com/security/cve/CVE-2026-48615
- externalhttps://access.redhat.com/security/cve/CVE-2026-48936
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9455.json