Red Hat Security Advisory

RHSA-2026:7655

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-04-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images yarnpkg-1.22.22-18.1.hum1@aarch64, yarnpkg-1.22.22-18.1.hum1@src, yarnpkg-1.22.22-18.1.hum1@x86_64

TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-07-08 Partial fix · 5.2.1, 3.15.1 +1 CWE-407

TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00644 Published 2026-07-08 Fixed in 5.2.0 CWE-407

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-02542 CVE-2026-2950 · GHSA-f23m-r3pf-42rh

LOW 35

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00337 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-1321

TI-2026-32977 CVE-2026-45149 · GHSA-jxxr-4gwj-5jf2

LOW 33

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.003 Published 2026-05-29 Partial fix · 5.0.6 CWE-400