Red Hat Security AdvisoryRHSA-2026:68755
Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
Released 2026-09-17 · Red Hat rating Important · View on Red Hat →
Fixes 15 records
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00608 · Published 2026-07-27 · Partial fix · 8.5.12 CWE-200
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00669 · Published 2026-06-12 · Partial fix · 2.5.6, 3.0.5 +1 CWE-93
Priority HIGH 72
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0053 · Published 2026-08-17 · Partial fix · 8.5.18 CWE-22
Priority HIGH 72
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00658 · Published 2026-08-11 · Partial fix · 4.28.7 CWE-1321
Priority HIGH 70
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00534 · Published 2026-08-01 · Partial fix · 0.33.0, 1.18.0 CWE-674
Priority HIGH 67
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00521 · Published 2026-08-01 · Fixed in 1.18.0, 0.33.0 CWE-400
Priority MEDIUM 61
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00411 · Published 2026-08-01 · Partial fix · 1.18.0 CWE-1321
Priority MEDIUM 40
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00655 · Published 2026-08-11 · Partial fix · 4.28.7 CWE-770
Priority LOW 39
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00398 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-436
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00232 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-177
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-20
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-174
Priority LOW 37
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00523 · Published 2026-08-01 · Partial fix · 0.33.0, 1.18.0 CWE-200
Priority LOW 36
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
CVSS 4.0MEDIUM 6.6· Network · No auth · No interaction · EPSS 0.00507 · Published 2026-08-13 · Partial fix · 2.11.0 CWE-705
Priority LOW 34
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-08-11 · Partial fix · 3.3.12, 5.1.11 CWE-190
THREATIST.IORead the docs