Red Hat Security Advisory

RHSA-2026:57590

rh-podman-desktop security, bug fix, and enhancement update

Released 2026-08-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2

Fixes 24 records

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

node-tar: Decompression/parse DoS via unlimited input

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-33367 CVE-2026-45623 · GHSA-6g55-p6wh-862q

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

HIGH 78

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00608 Published 2026-07-27 Partial fix · 8.5.12 CWE-200

TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w

node-tar: Negative tar entry size causes infinite loop in archive replace

HIGH 77

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2026-07-08 Partial fix · 7.5.18 CWE-835

TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4

linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

HIGH 77

linkify-it is a links recognition library with full Unicode support.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00394 Published 2026-07-14 Partial fix · 5.0.1 CWE-1333

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-48541 CVE-2026-69192 · GHSA-mwp4-54f8-5fhr

Improper input validation in beaugunderson ip-address

HIGH 75

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00465 Published 2026-08-03 Partial fix · 10.3.1 CWE-20

TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

HIGH 72

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00647 Published 2026-08-03 Partial fix · 1.1.18, 2.1.4 +2 CWE-400

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-41002 CVE-2026-56876 · GHSA-jmr9-qjv8-65gv

extract-zip unvalidated symlink path traversal

HIGH 72

extract-zip does not validate symlink targets when extracting zip archives.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00526 Published 2026-06-26 Partial fix CWE-22

TI-2026-36049 CVE-2026-48779 · GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

HIGH 72

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01426 Published 2026-06-16 Partial fix · 5.2.5, 6.2.4 +2 CWE-400

TI-2026-32592 CVE-2026-44705 · GHSA-ph9p-34f9-6g65

tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

HIGH 69

tmp is a temporary file and directory creator for node.js.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00434 Published 2026-06-11 Partial fix · 0.2.6 CWE-22

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp

Information disclosure in postcss

MEDIUM 61

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00451 Published 2026-08-03 Partial fix · 8.5.19, 8.5.23 CWE-200

TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

MEDIUM 61

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 4.0MEDIUM 6.3 Network No auth User interaction EPSS 0.00404 Published 2026-07-14 Partial fix · 3.4.6, 3.4.7 CWE-79

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

ip-address: XSS in Address6 HTML-emitting methods

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-35509 CVE-2026-48068 · GHSA-5375-pq7m-f5r2

@grpc/grps-js: A malformed request can cause a server crash

MEDIUM 41

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00882 Published 2026-07-14 Partial fix · 1.9.16, 1.11.4 +4 CWE-248

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

MEDIUM 40

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00643 Published 2026-07-23 Partial fix · 5.0.8, 3.0.3 +2 CWE-400

TI-2026-11539 CVE-2026-13676 · GHSA-4c8g-83qw-93j6

fast-uri vulnerable to host confusion via failed IDN canonicalization

MEDIUM 40

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00692 Published 2026-06-29 Partial fix · 4.0.1, 3.1.3 +1 CWE-436

TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp

Uncontrolled resource consumption in juliangruber brace-expansion

MEDIUM 40

brace-expansion through 5.0.6 is vulnerable to denial of service.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00364 Published 2026-06-30 Partial fix · 5.0.7, 1.1.16 +1 CWE-400

TI-2026-42691 CVE-2026-59877 · GHSA-j3f2-48v5-ccww

protobufjs: Denial of Service via infinite loop in .proto option parsing

LOW 39

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2026-07-08 Partial fix · 7.6.5, 8.6.6 CWE-835

TI-2026-30850 CVE-2026-42570 · GHSA-77vg-94rm-hx3p

Svelte devalue: DoS via sparse array deserialization

LOW 39

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2026-06-09 Partial fix · 5.8.1 CWE-770

TI-2026-33477 CVE-2026-45740 · GHSA-jggg-4jg4-v7c6

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

LOW 38

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00263 Published 2026-05-13 Partial fix · 7.5.8, 8.2.0 CWE-674

TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

LOW 29

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00163 Published 2026-06-15 Partial fix · 5.2.5 CWE-346