Red Hat Security Advisory

RHSA-2026:49387

Red Hat Hardened Images RPMs Security Update

Released 2026-08-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.1-13.1.1-0.4.hum1@aarch64, grafana13.1-13.1.1-0.4.hum1@src, grafana13.1-13.1.1-0.4.hum1@x86_64

Fixes 2 records

TI-2026-47615 CVE-2026-67319 · GHSA-7q8q-rj6j-mhjq

axios before 0.33.0 Prototype Pollution via nested option objects

MEDIUM 61

axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00318 Published 2026-08-01 Partial fix · 0.33.0, 1.18.0 CWE-1321

TI-2026-15158 CVE-2026-18446 · GHSA-7p8r-x3mc-p8w7

fast-uri vulnerable to host confusion via backslash authority introducer

LOW 39

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backs…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0038 Published 2026-07-31 Partial fix · 4.1.2, 3.1.5 +1 CWE-436