Red Hat Security Advisory

RHSA-2026:35272

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-07-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images nodejs22-1:22.23.1-2.hum1@aarch64, nodejs22-1:22.23.1-2.hum1@src, nodejs22-1:22.23.1-2.hum1@x86_64 +14

Fixes 9 records

TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm

js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-07-08 Partial fix · 5.2.1, 3.15.1 +1 CWE-407

TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00644 Published 2026-07-08 Fixed in 5.2.0 CWE-407

TI-2026-36189 CVE-2026-48930 · GHSA-g779-8rvr-37xx

Improper access control in NodeJS node

MEDIUM 42

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00315 Published 2026-06-26 Partial fix CWE-284

TI-2026-35965 CVE-2026-48619 · GHSA-v3cq-r2f8-qmmc

Uncontrolled resource consumption in NodeJS node

MEDIUM 40

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00639 Published 2026-06-26 Partial fix CWE-400

TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp

Uncontrolled resource consumption in juliangruber brace-expansion

MEDIUM 40

brace-expansion through 5.0.6 is vulnerable to denial of service.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00364 Published 2026-06-30 Partial fix · 5.0.7, 1.1.16 +1 CWE-400

TI-2026-36187 CVE-2026-48928 · GHSA-3h92-9jcv-8677

Improper access control in NodeJS node

LOW 24

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00216 Published 2026-06-26 Partial fix CWE-284

TI-2026-36193 CVE-2026-48934 · GHSA-px9q-xv67-75fr

Improper certificate validation in NodeJS node

LOW 20

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00258 Published 2026-06-26 Partial fix CWE-295

TI-2026-36195 CVE-2026-48936 · GHSA-hwhp-f859-r728

Improper access control in NodeJS node

LOW 15

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.

CVSS 3.0LOW 3.3 Local Low privileges No interaction EPSS 0.00135 Published 2026-06-26 Partial fix CWE-284

TI-2026-36194 CVE-2026-48935 · GHSA-9qm6-cjgc-f64v

Incorrect default permissions in NodeJS node

LOW 15

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.

CVSS 3.0LOW 3.3 Local Low privileges No interaction EPSS 0.00185 Published 2026-06-26 Partial fix CWE-276