Red Hat Security Advisory

RHSA-2026:0261

Red Hat Developer Hub 1.7.4 release.

Released 2026-01-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9

Fixes 5 records

TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27

node-forge ASN.1 Unbounded Recursion

MEDIUM 44

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00446 Published 2025-11-26 Partial fix · 1.3.2 CWE-674

TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…

MEDIUM 44

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0058 Published 2025-11-25 Partial fix · 1.3.2 CWE-436

TI-2025-40094 CVE-2025-64756 · GHSA-5j98-mcp5-4vw2

glob CLI: Command injection via -c/--cmd executes matches with shell:true

MEDIUM 40

Glob matches files using patterns the shell uses.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0309 Published 2025-11-17 Partial fix · 10.5.0, 11.1.0 CWE-78

TI-2025-40515 CVE-2025-65945 · GHSA-869p-cjfg-cm3x

auth0/node-jws improper HMAC signature verification vulnerability

LOW 38

auth0/node-jws is a JSON Web Signature implementation for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00231 Published 2025-12-04 Partial fix · 3.2.3, 4.0.1 CWE-347

TI-2025-13959 CVE-2025-15284 · GHSA-6rw7-vpxm-498p

arrayLimit bypass in bracket notation allows DoS via memory exhaustion

LOW 34

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0045 Published 2025-12-29 Partial fix · 6.14.1 CWE-20