Red Hat Security Advisory

RHSA-2026:47619

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-07-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana12.4-12.4.6-0.2.hum1@aarch64, grafana12.4-12.4.6-0.2.hum1@src, grafana12.4-12.4.6-0.2.hum1@x86_64

Fixes 6 records

TI-2026-47617 CVE-2026-67321 · GHSA-hcpx-6fm6-wx23

axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

HIGH 70

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00534 Published 2026-08-01 Partial fix · 0.33.0, 1.18.0 CWE-674

TI-2026-47608 CVE-2026-67312 · GHSA-pmv8-rq9r-6j72

axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON

MEDIUM 61

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: appli…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00521 Published 2026-08-01 Partial fix · 0.33.0, 1.18.0 CWE-400

TI-2026-30467 CVE-2026-42127 · GHSA-3w66-95m3-8jxg

Pre-authentication denial of service in the public dashboard query endpoint

LOW 39

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00432 Published 2026-06-22 Partial fix · 1.9.2-0.20260616075434-82ef13993059 CWE-400

TI-2026-47616 CVE-2026-67320 · GHSA-gcfj-64vw-6mp9

axios before 0.33.0 Prototype Pollution via Node HTTP adapter

LOW 37

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00523 Published 2026-08-01 Partial fix · 0.33.0, 1.18.0 CWE-200

TI-2026-47529 CVE-2026-67213 · GHSA-2v37-7h3g-55p8

nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

LOW 36

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-07-29 Partial fix · 3.3.17, 5.1.6 +1 CWE-835

TI-2026-40928 CVE-2026-56764 · GHSA-98q5-3v5r-qvfh

Hono - Timing Attack in basicAuth and bearerAuth Middleware

LOW 28

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00297 Published 2026-07-15 Partial fix · 4.11.10 CWE-208