Read the docs
Red Hat Security Advisory

RHSA-2026:48758

Red Hat Hardened Images RPMs Security Update

Released 2026-07-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2026-47609 CVE-2026-67313 · GHSA-42h9-826w-cgv3

axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON

Priority HIGH 67

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00521 Published 2026-08-01 Fixed in 1.18.0, 0.33.0 CWE-400
TI-2026-47610 CVE-2026-67314 · GHSA-xj6q-8x83-jv6g

axios before 1.18.0 Prototype Pollution via auth subfields

Priority MEDIUM 61

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00411 Published 2026-08-01 Partial fix · 1.18.0 CWE-1321
TI-2026-47608 CVE-2026-67312 · GHSA-pmv8-rq9r-6j72

axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON

Priority MEDIUM 61

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: appli…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00521 Published 2026-08-01 Partial fix · 0.33.0, 1.18.0 CWE-400
TI-2026-47616 CVE-2026-67320 · GHSA-gcfj-64vw-6mp9

axios before 0.33.0 Prototype Pollution via Node HTTP adapter

Priority LOW 37

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00523 Published 2026-08-01 Partial fix · 0.33.0, 1.18.0 CWE-200
TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4

pyOpenSSL DTLS cookie callback buffer overflow

Priority LOW 35

pyOpenSSL is a Python wrapper around the OpenSSL library.

CVSS 4.0HIGH 7.2 Network No auth No interaction EPSS 0.00748 Published 2026-03-17 Partial fix · 26.0.0 CWE-120
TI-2026-51293 CVE-2026-73086 · GHSA-xwg4-73v4-xw9w

nanoid: Integer Overflow or Wraparound

Priority LOW 34

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00296 Published 2026-08-11 Partial fix · 3.3.12, 5.1.11 CWE-190