Red Hat Security Advisory

RHSA-2026:50287

Red Hat Hardened Images RPMs Security Update

Released 2026-08-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images prometheus3.13-3.13.2-0.2.hum1@aarch64, prometheus3.13-3.13.2-0.2.hum1@src, prometheus3.13-3.13.2-0.2.hum1@x86_64

Fixes 4 records

TI-2026-51730 CVE-2026-73646 · GHSA-r28c-9q8g-f849

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

HIGH 72

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0053 Published 2026-08-17 Partial fix · 8.5.18 CWE-22

TI-2026-51041 CVE-2026-72815 · GHSA-qgxv-hqxp-4rcx

go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

HIGH 70

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00495 Published 2026-08-14 Partial fix · 5.3.0 CWE-290

TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp

Information disclosure in postcss

MEDIUM 61

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00451 Published 2026-08-03 Partial fix · 8.5.19, 8.5.23 CWE-200

TI-2026-51293 CVE-2026-73086 · GHSA-xwg4-73v4-xw9w

nanoid: Integer Overflow or Wraparound

LOW 34

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00296 Published 2026-08-11 Partial fix · 3.3.12, 5.1.11 CWE-190