Red Hat Security Advisory

RHSA-2026:74872

Red Hat Hardened Images RPMs Security Update

Released 2026-10-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana13.2-13.2.1-0.9.hum1@aarch64, grafana13.2-13.2.1-0.9.hum1@src, grafana13.2-13.2.1-0.9.hum1@x86_64

Fixes 11 records

TI-2026-65210 CVE-2026-101909 · GHSA-x97p-jq2g-jp4f

Axios: Prototype Pollution Gadget in axios toFormData Options

HIGH 77

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00497 Published 2026-09-28 Fixed in 1.20.0, 0.34.0 CWE-1321

TI-2026-65207 CVE-2026-101906 · GHSA-mghh-pgcx-3jjj

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

HIGH 75

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00457 Published 2026-09-28 Fixed in 1.20.0 CWE-1333

TI-2026-65202 CVE-2026-101901 · GHSA-542g-h47m-68v8

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

HIGH 75

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00536 Published 2026-09-28 Fixed in 1.20.0 CWE-400

TI-2026-65206 CVE-2026-101905 · GHSA-m8m8-qj5v-23w3

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

HIGH 74

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00418 Published 2026-09-28 Fixed in 1.20.0 CWE-1321

TI-2026-65203 CVE-2026-101902 · GHSA-9fr6-4gfg-395g

Prototype pollution in axios

HIGH 70

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00414 Published 2026-09-28 Fixed in 1.20.0, 0.34.0 CWE-1321

TI-2026-65204 CVE-2026-101903 · GHSA-c29m-xwm3-cm6r

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

HIGH 69

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00436 Published 2026-09-28 Fixed in 1.20.0 CWE-1333

TI-2026-65209 CVE-2026-101908 · GHSA-vh66-26gq-q6x8

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

MEDIUM 64

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00471 Published 2026-09-28 Fixed in 1.20.0 CWE-1321

TI-2026-65208 CVE-2026-101907 · GHSA-r4gj-5m52-g5wh

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

MEDIUM 64

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00471 Published 2026-09-28 Fixed in 1.20.0 CWE-441

TI-2026-65205 CVE-2026-101904 · GHSA-j8rh-479h-cp32

Axios: Header Injection via Inherited headers After Minimal Interceptor

MEDIUM 64

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00488 Published 2026-09-28 Fixed in 1.20.0 CWE-1321

TI-2026-65201 CVE-2026-101900 · GHSA-4hqw-qxg8-jxx2

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

MEDIUM 64

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00546 Published 2026-09-28 Fixed in 1.20.0 CWE-1321

TI-2026-65200 CVE-2026-101898 · GHSA-3pq3-5fj3-cg6v

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

MEDIUM 64

Axios is a promise-based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00545 Published 2026-09-28 Fixed in 1.20.0 CWE-918