Red Hat Security AdvisoryRHSA-2026:24841
Red Hat Developer Hub 1.10.0 release.
Released 2026-06-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9
Fixes 7 records
Priority HIGH 70
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00568 · Published 2026-03-11 · Partial fix · 3.2.1 CWE-193
Priority MEDIUM 60
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-03-24 · Partial fix · 5.5.7, 4.5.5 CWE-1284
Priority LOW 38
Underscore.js is a utility-belt library for JavaScript.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.01063 · Published 2026-03-03 · Partial fix · 1.13.8 CWE-770
Priority LOW 35
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00337 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-1321
Priority LOW 33
Undici is an HTTP/1.1 client for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00457 · Published 2026-01-14 · Partial fix · 6.23.0, 7.18.2 CWE-770
Priority LOW 26
Backstage is an open framework for building developer portals.
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00167 · Published 2026-03-12 · Partial fix · 0.27.1 CWE-601
Priority LOW 26
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00359 · Published 2026-03-26 · Partial fix · 8.4.0 CWE-1333
THREATIST.IORead the docs