Red Hat Security Advisory

RHSA-2026:65155

Ansible plug-ins for Red Hat Developer Hub Product Release Update

Released 2026-09-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal

Fixes 11 records

TI-2026-51656 CVE-2026-73566 · GHSA-r292-9mhp-454m

Uncontrolled resource consumption in isaacs node-tar

HIGH 72

node-tar is a tar archive manipulation library for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00531 Published 2026-08-13 Partial fix · 7.5.21 CWE-400

TI-2026-53084 CVE-2026-75838 · GHSA-748c-f84h-hp2v

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

MEDIUM 56

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00394 Published 2026-08-18 Partial fix · 3.4.13 CWE-79

TI-2026-58005 CVE-2026-84394 · GHSA-58mr-gqgx-xq4g

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

LOW 39

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0038 Published 2026-09-02 Partial fix · 2.4.6, 3.1.7 +1 CWE-436

TI-2026-53157 CVE-2026-75931 · GHSA-5jgf-p345-68v8

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

LOW 39

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00398 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-436

TI-2026-57933 CVE-2026-84292 · GHSA-qw65-cvwx-89v3

fast-uri vulnerable to authority injection via an unvalidated port in serialize

LOW 38

fast-uri serializes the port component of a URI without validating it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00239 Published 2026-09-02 Partial fix · 2.4.6, 3.1.7 +1 CWE-116

TI-2026-53285 CVE-2026-76172 · GHSA-jqff-g426-hqxp

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

LOW 38

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00232 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-177

TI-2026-53188 CVE-2026-75975 · GHSA-f65p-4m7j-42xc

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

LOW 38

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0022 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-20

TI-2026-53132 CVE-2026-75899 · GHSA-fph4-wmhf-6fwf

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

LOW 38

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0022 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-174

TI-2026-47530 CVE-2026-67214 · GHSA-28wg-ghj8-5hjv

nanoid Infinite Loop via Negative Size in non-secure module

LOW 36

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0033 Published 2026-07-29 Partial fix · 5.1.16, 3.3.16 CWE-835

TI-2026-47529 CVE-2026-67213 · GHSA-2v37-7h3g-55p8

nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

LOW 36

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-07-29 Partial fix · 3.3.17, 5.1.6 +1 CWE-835

TI-2026-51653 CVE-2026-73563 · GHSA-38hq-7x33-php4

Open redirect in backstage

LOW 26

Backstage is an open framework for building developer portals.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00172 Published 2026-08-13 Fixed in 0.29.2 CWE-601