Red Hat Security Advisory

RHSA-2026:33574

Red Hat Developer Hub 1.9.6 release.

Released 2026-06-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Fixes 31 records

TI-2026-34796 CVE-2026-47208 · GHSA-76w7-j9cq-rx2j

vm2: Sandbox Breakout Using Promise Species

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01038 Published 2026-06-12 Partial fix · 3.11.4 CWE-913

TI-2026-34731 CVE-2026-47140 · GHSA-rp36-8xq3-r6c4

vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00978 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-34728 CVE-2026-47137 · GHSA-m4wx-m65x-ghrr

vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00382 Published 2026-06-12 Fixed in 3.11.4 CWE-913

TI-2026-34722 CVE-2026-47131 · GHSA-v6mx-mf47-r5wg

vm2: Sandbox Escape

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00757 Published 2026-06-12 Fixed in 3.11.4 CWE-913

TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7

Server-side request forgery in axios

HIGH 82

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00711 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-183

TI-2026-34797 CVE-2026-47209 · GHSA-c4cf-2hgv-2qv6

vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00287 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-34730 CVE-2026-47139 · GHSA-r9pm-gxmw-wv6p

vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00359 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv

Server-side request forgery in axios

HIGH 76

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1228 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-918

TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

HIGH 73

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01057 Published 2026-06-11 Partial fix · 1.16.0 CWE-1321

TI-2026-36049 CVE-2026-48779 · GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

HIGH 72

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01426 Published 2026-06-16 Partial fix · 5.2.5, 6.2.4 +2 CWE-400

TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05405 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-1333

TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf

Axios: Allocation of Resources Without Limits or Throttling in axios

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2026-06-11 Partial fix · 1.16.0 CWE-770

TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-200

TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00618 Published 2026-04-24 Partial fix · 1.15.2 CWE-1321

TI-2026-34732 CVE-2026-47141 · GHSA-9g8x-92q2-p28f

vm2: NodeVM observability builtins leak host process and HTTP request data

HIGH 70

vm2 is an open source vm/sandbox for Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00383 Published 2026-06-12 Fixed in 3.11.4 CWE-668

TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9

Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

HIGH 70

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00772 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-674

TI-2026-32611 CVE-2026-44724 · GHSA-hvx9-hwr7-wjj9

systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

HIGH 69

systeminformation is a System and OS information library for node.js.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00915 Published 2026-05-27 Fixed in 5.31.6 CWE-78

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00689 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-201

TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00403 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-113

TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00867 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-1321

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

MEDIUM 62

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00656 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-1321

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

ip-address: XSS in Address6 HTML-emitting methods

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf

Quadratic string concatenation in consumePhrase in net/mail

MEDIUM 40

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00798 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3

TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5

Quadratic string concatentation in consumeComment in net/mail

MEDIUM 40

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00784 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-770

TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478

Crash when handling long CNAME response in net

MEDIUM 40

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00875 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-415

TI-2026-34726 CVE-2026-47135 · GHSA-m5q2-4fm3-vfqp

vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

LOW 39

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00266 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r

Inefficient candidate hostname parsing in crypto/x509

LOW 30

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00591 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4

TI-2026-08484 CVE-2026-9673 · GHSA-g27c-q7cp-mhx6

CSV injection in json-2-csv

LOW 30

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed.

CVSS 4.0HIGH 7.0 Local No auth No interaction EPSS 0.00166 Published 2026-05-28 Fixed in 5.5.11 CWE-1236