Red Hat Security AdvisoryRHSA-2026:21338
Red Hat Developer Hub 1.8.7 release.
Released 2026-05-27 · Red Hat rating Important · View on Red Hat →
Fixes 14 records
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00711 · Published 2026-04-24 · Partial fix · 1.15.1, 0.31.1 CWE-183
Priority HIGH 82
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
CVSS 4.0CRITICAL 9.4· Network · Low privileges · No interaction · EPSS 0.00774 · Published 2026-04-18 · Partial fix · 7.5.5, 8.0.1 +1 CWE-94
Priority HIGH 77
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00565 · Published 2026-05-07 · Partial fix · 0.8.13, 0.9.10 CWE-91
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00618 · Published 2026-04-24 · Partial fix · 1.15.2 CWE-1321
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00772 · Published 2026-04-24 · Partial fix · 1.15.1, 0.31.1 CWE-674
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00403 · Published 2026-04-24 · Partial fix · 1.15.1, 0.31.1 CWE-113
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00867 · Published 2026-04-24 · Partial fix · 1.15.1, 0.31.1 CWE-1321
Priority MEDIUM 62
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00656 · Published 2026-04-24 · Partial fix · 1.15.1, 0.31.1 CWE-1321
Priority MEDIUM 60
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
CVSS 4.0MEDIUM 6.0· Network · No auth · User interaction · EPSS 0.00313 · Published 2026-04-23 · Partial fix · 3.4.0 CWE-183
Priority MEDIUM 40
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00626 · Published 2026-04-08 · Partial fix · 1.25.9, 1.26.2 CWE-770
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00634 · Published 2026-05-04 · Partial fix · 3.1.1, 2.4.1 CWE-22
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00361 · Published 2026-04-08 · Partial fix · 1.25.9, 1.26.2 CWE-295
Priority LOW 31
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00486 · Published 2026-04-21 · Partial fix · 1.16.0 CWE-200
Priority LOW 30
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.00297 · Published 2026-04-08 · Partial fix · 1.25.9, 1.26.2 CWE-59