Red Hat Security Advisory

RHSA-2026:93601

Red Hat Hardened Images RPMs Security Update

Released 2026-11-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Hardened Images grafana12.4-12.4.13-0.6.hum1@aarch64, grafana12.4-12.4.13-0.6.hum1@src, grafana12.4-12.4.13-0.6.hum1@x86_64

Fixes 4 records

TI-2026-81522 CVE-2026-116689 · GHSA-mrwp-f3q8-3g9p

Credential headers forwarded on redirects in follow-redirects

MEDIUM 60

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00266 Published 2026-10-27 Partial fix · 1.16.2 CWE-201

TI-2026-80931 CVE-2026-116591 · GHSA-fpmh-frq8-7rj8

compress zstd: Panic on two-block frames

MEDIUM 44

compress provides various compression algorithms.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00333 Published 2026-10-26 Partial fix · 1.20.2 CWE-190

TI-2026-79895 CVE-2026-115754 · GHSA-cvqw-cqhx-qmxc

Cross-site scripting in serialize-javascript via unescaped script tag

LOW 12

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00231 Published 2026-10-23 Fixed in 7.1.3 CWE-79

TI-2026-80005 CVE-2026-115897 · GHSA-m5mm-p8h7-m29v

Cross-site scripting in serialize-javascript via unescaped closing script prefix

LOW 11

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00307 Published 2026-10-23 Fixed in 7.1.3 CWE-79