Red Hat Security Advisory

RHSA-2026:22380

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-06-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images nodejs26-26.3.0-1.2.hum1@aarch64, nodejs26-26.3.0-1.2.hum1@src, nodejs26-26.3.0-1.2.hum1@x86_64 +14

Fixes 5 records

TI-2026-05900 CVE-2026-6734 · GHSA-hm92-r4w5-c3mj

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

MEDIUM 40

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00345 Published 2026-06-17 Partial fix · 7.26.0, 8.2.0 +1 CWE-346

TI-2026-08486 CVE-2026-9675 · GHSA-38rv-x7px-6hhq

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass

LOW 39

Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompressed messages.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00426 Published 2026-06-17 Partial fix · 8.5.0 CWE-400

TI-2026-08499 CVE-2026-9697 · GHSA-vmh5-mc38-953g

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

LOW 35

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00459 Published 2026-06-17 Partial fix · 7.28.0, 8.5.0 CWE-295

TI-2026-32977 CVE-2026-45149 · GHSA-jxxr-4gwj-5jf2

brace-expansion: Large numeric range defeats documented `max` DoS protection

LOW 33

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.003 Published 2026-05-29 Partial fix · 5.0.6 CWE-400

TI-2026-08489 CVE-2026-9678 · GHSA-pr7r-676h-xcf6

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

LOW 27

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorizatio…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00388 Published 2026-06-17 Partial fix · 7.28.0, 8.5.0 CWE-524