Red Hat Security Advisory

RHSA-2026:36754

Red Hat Developer Hub 1.10.2 release.

Released 2026-07-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Fixes 29 records

TI-2026-34798 CVE-2026-47210 · GHSA-6j2x-vhqr-qr7q

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01716 Published 2026-06-12 Partial fix · 3.11.4 CWE-913

TI-2026-34796 CVE-2026-47208 · GHSA-76w7-j9cq-rx2j

vm2: Sandbox Breakout Using Promise Species

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01038 Published 2026-06-12 Partial fix · 3.11.4 CWE-913

TI-2026-34731 CVE-2026-47140 · GHSA-rp36-8xq3-r6c4

vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00978 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-34728 CVE-2026-47137 · GHSA-m4wx-m65x-ghrr

vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00382 Published 2026-06-12 Fixed in 3.11.4 CWE-913

TI-2026-34722 CVE-2026-47131 · GHSA-v6mx-mf47-r5wg

vm2: Sandbox Escape

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00757 Published 2026-06-12 Fixed in 3.11.4 CWE-913

TI-2026-19982 CVE-2026-24781 · GHSA-v37h-5mfm-c47c

vm2: Sandbox Breakout Through Inspect

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01186 Published 2026-05-04 Partial fix · 3.11.0 CWE-693

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-34730 CVE-2026-47139 · GHSA-r9pm-gxmw-wv6p

vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00359 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv

Server-side request forgery in axios

HIGH 76

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1228 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-918

TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

HIGH 73

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01057 Published 2026-06-11 Partial fix · 1.16.0 CWE-1321

TI-2026-36049 CVE-2026-48779 · GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

HIGH 72

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01426 Published 2026-06-16 Partial fix · 5.2.5, 6.2.4 +2 CWE-400

TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05405 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-1333

TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf

Axios: Allocation of Resources Without Limits or Throttling in axios

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2026-06-11 Partial fix · 1.16.0 CWE-770

TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-200

TI-2026-34732 CVE-2026-47141 · GHSA-9g8x-92q2-p28f

vm2: NodeVM observability builtins leak host process and HTTP request data

HIGH 70

vm2 is an open source vm/sandbox for Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00383 Published 2026-06-12 Fixed in 3.11.4 CWE-668

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00689 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-201

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

ip-address: XSS in Address6 HTML-emitting methods

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf

Quadratic string concatenation in consumePhrase in net/mail

MEDIUM 40

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00798 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3

TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5

Quadratic string concatentation in consumeComment in net/mail

MEDIUM 40

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00784 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-770

TI-2026-10459 CVE-2026-12151 · GHSA-vxpw-j846-p89q

undici WebSocket client vulnerable to denial of service via fragment count bypass

MEDIUM 40

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00789 Published 2026-06-17 Partial fix · 6.26.0, 7.28.0 +2 CWE-400

TI-2026-05900 CVE-2026-6734 · GHSA-hm92-r4w5-c3mj

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

MEDIUM 40

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00345 Published 2026-06-17 Partial fix · 7.26.0, 8.2.0 +1 CWE-346

TI-2026-34726 CVE-2026-47135 · GHSA-m5q2-4fm3-vfqp

vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

LOW 39

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00266 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

LOW 39

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00512 Published 2026-05-05 Partial fix · 3.1.2, 2.4.1 CWE-436

TI-2026-08499 CVE-2026-9697 · GHSA-vmh5-mc38-953g

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

LOW 35

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00459 Published 2026-06-17 Partial fix · 7.28.0, 8.5.0 CWE-295

TI-2026-08484 CVE-2026-9673 · GHSA-g27c-q7cp-mhx6

CSV injection in json-2-csv

LOW 30

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed.

CVSS 4.0HIGH 7.0 Local No auth No interaction EPSS 0.00166 Published 2026-05-28 Fixed in 5.5.11 CWE-1236

TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021