Red Hat Security Advisory

RHSA-2026:68747

General availability of the satellite/iop-remediations-rhel9 container image

Released 2026-09-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9

Fixes 11 records

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

js-yaml: YAML merge-key chains can force quadratic CPU consumption

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-32592 CVE-2026-44705 · GHSA-ph9p-34f9-6g65

tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

HIGH 69

tmp is a temporary file and directory creator for node.js.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00434 Published 2026-06-11 Partial fix · 0.2.6 CWE-22

TI-2026-56824 CVE-2026-82417 · GHSA-4mjr-xmp4-gh2g

qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property

HIGH 67

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00396 Published 2026-08-29 Partial fix · 6.16.0 CWE-248

TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

MEDIUM 40

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00541 Published 2026-09-01 Partial fix · 3.15.2, 4.3.2 +1 CWE-400

TI-2026-58005 CVE-2026-84394 · GHSA-58mr-gqgx-xq4g

fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

LOW 39

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0038 Published 2026-09-02 Partial fix · 2.4.6, 3.1.7 +1 CWE-436

TI-2026-53157 CVE-2026-75931 · GHSA-5jgf-p345-68v8

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

LOW 39

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00398 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-436

TI-2026-57933 CVE-2026-84292 · GHSA-qw65-cvwx-89v3

fast-uri vulnerable to authority injection via an unvalidated port in serialize

LOW 38

fast-uri serializes the port component of a URI without validating it.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00239 Published 2026-09-02 Partial fix · 2.4.6, 3.1.7 +1 CWE-116

TI-2026-53285 CVE-2026-76172 · GHSA-jqff-g426-hqxp

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

LOW 38

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00232 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-177

TI-2026-53188 CVE-2026-75975 · GHSA-f65p-4m7j-42xc

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

LOW 38

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0022 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-20

TI-2026-53132 CVE-2026-75899 · GHSA-fph4-wmhf-6fwf

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

LOW 38

fast-uri is a URI parser for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0022 Published 2026-08-24 Partial fix · 2.4.5, 3.1.6 +1 CWE-174