Red Hat Security Advisory

RHSA-2026:44267

OpenShift Container Platform 4.21.26 bug fix and security update

Released 2026-07-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +1

Fixes 9 records

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

node-tar: Decompression/parse DoS via unlimited input

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

ip-address: XSS in Address6 HTML-emitting methods

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2

SpdyStream: DOS on CRI

MEDIUM 45

spdystream is a Go library for multiplexing streams over SPDY connections.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00656 Published 2026-04-16 Partial fix · 0.5.1 CWE-770

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-29551 CVE-2026-40895

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

LOW 31

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00486 Published 2026-04-21 Partial fix · 1.16.0 CWE-200