{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs26:\n  * nodejs26-26.3.0-1.2.hum1 (aarch64, x86_64)\n  * nodejs26-bin-26.3.0-1.2.hum1 (noarch)\n  * nodejs26-devel-26.3.0-1.2.hum1 (aarch64, x86_64)\n  * nodejs26-docs-26.3.0-1.2.hum1 (noarch)\n  * nodejs26-full-i18n-26.3.0-1.2.hum1 (aarch64, x86_64)\n  * nodejs26-libs-26.3.0-1.2.hum1 (aarch64, x86_64)\n  * nodejs26-npm-11.16.0-1.26.3.0.1.2.hum1 (noarch)\n  * nodejs26-npm-bin-26.3.0-1.2.hum1 (noarch)\n  * v8-14.6-devel-14.6.202.34-1.26.3.0.1.2.hum1 (aarch64, x86_64)\n  * nodejs26-26.3.0-1.2.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:22380",
        "url": "https://access.redhat.com/errata/RHSA-2026:22380"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9697",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9697"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6734",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6734"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9675",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9675"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9678",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9678"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22380.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-06-19T13:47:09+00:00",
      "generator": {
        "date": "2026-06-19T13:47:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.0.0"
        }
      },
      "id": "RHSA-2026:22380",
      "initial_release_date": "2026-06-02T03:47:28+00:00",
      "revision_history": [
        {
          "date": "2026-06-02T03:47:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-18T11:12:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-19T13:47:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-main@aarch64",
                "product": {
                  "name": "nodejs26-main@aarch64",
                  "product_id": "nodejs26-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.3.0-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-main@src",
                "product": {
                  "name": "nodejs26-main@src",
                  "product_id": "nodejs26-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.3.0-1.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-main@x86_64",
                "product": {
                  "name": "nodejs26-main@x86_64",
                  "product_id": "nodejs26-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.3.0-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-main@noarch",
                "product": {
                  "name": "nodejs26-main@noarch",
                  "product_id": "nodejs26-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.3.0-1.2.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-main@aarch64"
        },
        "product_reference": "nodejs26-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-main@noarch"
        },
        "product_reference": "nodejs26-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-main@src"
        },
        "product_reference": "nodejs26-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-main@x86_64"
        },
        "product_reference": "nodejs26-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6734",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "discovery_date": "2026-06-17T19:04:00.272340+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490024"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When using Socks5ProxyAgent, undici incorrectly reuses a single connection pool across different origins. This can lead to cross-origin request routing, where sensitive credentials and data intended for one destination are sent to another. Consequently, responses from unintended origins may be trusted, and secure HTTPS connections could be silently downgraded to unencrypted HTTP, resulting in information disclosure and data integrity issues.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important security flaw. The `undici` library, when configured with `Socks5ProxyAgent` to handle requests for multiple origins, incorrectly reuses connection pools. This can lead to sensitive data and credentials being misrouted to unintended destinations, potentially downgrading HTTPS connections to HTTP and compromising data integrity and confidentiality. Red Hat products utilizing `undici` with `Socks5ProxyAgent` in multi-origin scenarios are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-main@aarch64",
          "Red Hat Hardened Images:nodejs26-main@noarch",
          "Red Hat Hardened Images:nodejs26-main@src",
          "Red Hat Hardened Images:nodejs26-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490024",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490024"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6734"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj"
        }
      ],
      "release_date": "2026-06-17T16:36:55.439000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-02T03:47:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22380"
        },
        {
          "category": "workaround",
          "details": "The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting \u2014 the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin \u2014 but they do not fix the underlying logic bug.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing"
    },
    {
      "cve": "CVE-2026-9678",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-06-17T19:01:33.359372+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490000"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Undici. The cache interceptor in shared-cache mode incorrectly classifies certain responses as cacheable due to improper handling of whitespace-padded Cache-Control header field names. This vulnerability allows an unauthenticated attacker to access authenticated user data from the cache, leading to information disclosure. This occurs when both authenticated and unauthenticated requests resolve to the same cache key.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Information disclosure due to improper cache-control header parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate information disclosure flaw in Undici\u0027s cache interceptor, when configured in shared-cache mode, allows an unauthenticated attacker to retrieve sensitive authenticated user data. This is due to incorrect parsing of Cache-Control headers containing whitespace-padded field names, leading to cached responses being served improperly. Red Hat products are affected if they explicitly enable shared-cache mode, forward Authorization headers, and process non-canonical Cache-Control directives.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-main@aarch64",
          "Red Hat Hardened Images:nodejs26-main@noarch",
          "Red Hat Hardened Images:nodejs26-main@src",
          "Red Hat Hardened Images:nodejs26-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9678"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490000",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490000"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9678",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9678"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9678",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9678"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6"
        }
      ],
      "release_date": "2026-06-17T17:04:09.680000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-02T03:47:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22380"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: Undici: Information disclosure due to improper cache-control header parsing"
    },
    {
      "cve": "CVE-2026-9697",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-06-17T19:03:30.813843+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490018"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When undici\u0027s ProxyAgent is configured with a SOCKS5 proxy Uniform Resource Identifier (URI), it silently ignores Transport Layer Security (TLS) options, such as custom Certificate Authorities (CAs). This allows a remote attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and tampering with HTTPS communications. The connection falls back to Node.js\u0027s default trust store, bypassing intended security configurations and potentially leading to information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability. Applications using `undici`\u0027s `ProxyAgent` with a SOCKS5 proxy URI will silently ignore user-configured TLS options, including custom Certificate Authorities. This bypasses intended security controls for HTTPS communication, enabling a remote attacker to perform Man-in-the-Middle attacks, potentially leading to information disclosure or arbitrary code execution in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-main@aarch64",
          "Red Hat Hardened Images:nodejs26-main@noarch",
          "Red Hat Hardened Images:nodejs26-main@src",
          "Red Hat Hardened Images:nodejs26-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9697"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490018",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490018"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9697",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9697"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9697",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9697"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g"
        }
      ],
      "release_date": "2026-06-17T16:46:42.706000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-02T03:47:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22380"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy"
    },
    {
      "cve": "CVE-2026-45149",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-29T21:02:00.092772+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483481"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a large numeric range for expansion. The library allocates excessive memory to generate all intermediate elements before applying the maximum limit, leading to high memory consumption and potential application crashes. This can impact the availability of systems using the library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-main@aarch64",
          "Red Hat Hardened Images:nodejs26-main@noarch",
          "Red Hat Hardened Images:nodejs26-main@src",
          "Red Hat Hardened Images:nodejs26-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483481",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483481"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2"
        }
      ],
      "release_date": "2026-05-29T19:55:07.337000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-02T03:47:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22380"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-main@aarch64",
            "Red Hat Hardened Images:nodejs26-main@noarch",
            "Red Hat Hardened Images:nodejs26-main@src",
            "Red Hat Hardened Images:nodejs26-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges"
    }
  ]
}