{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7378",
        "url": "https://access.redhat.com/errata/RHSA-2026:7378"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-59464",
        "url": "https://access.redhat.com/security/cve/CVE-2025-59464"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55132",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55132"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55131",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55131"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-55130",
        "url": "https://access.redhat.com/security/cve/CVE-2025-55130"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-2950",
        "url": "https://access.redhat.com/security/cve/CVE-2026-2950"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9697",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9697"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6734",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6734"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7378.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-06-18T07:23:03+00:00",
      "generator": {
        "date": "2026-06-18T07:23:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.0.0"
        }
      },
      "id": "RHSA-2026:7378",
      "initial_release_date": "2026-04-10T13:03:00+00:00",
      "revision_history": [
        {
          "date": "2026-04-10T13:03:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-18T01:09:19+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-18T07:23:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs25-main@aarch64",
                "product": {
                  "name": "nodejs25-main@aarch64",
                  "product_id": "nodejs25-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs25@25.9.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs25-main@src",
                "product": {
                  "name": "nodejs25-main@src",
                  "product_id": "nodejs25-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs25@25.9.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs25-main@x86_64",
                "product": {
                  "name": "nodejs25-main@x86_64",
                  "product_id": "nodejs25-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs25@25.9.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs25-main@noarch",
                "product": {
                  "name": "nodejs25-main@noarch",
                  "product_id": "nodejs25-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs25-bin@25.9.0-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs25-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs25-main@aarch64"
        },
        "product_reference": "nodejs25-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs25-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs25-main@noarch"
        },
        "product_reference": "nodejs25-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs25-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs25-main@src"
        },
        "product_reference": "nodejs25-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs25-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs25-main@x86_64"
        },
        "product_reference": "nodejs25-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-55130",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "discovery_date": "2026-01-20T21:03:01.083023+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431352"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Node.js\u2019s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Nodejs file permissions bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55130"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431352",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431352"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55130",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55130"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55130",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55130"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"
        }
      ],
      "release_date": "2026-01-20T20:41:55.393000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Nodejs file permissions bypass"
    },
    {
      "cve": "CVE-2025-55131",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "discovery_date": "2026-01-20T21:02:45.759578+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431350"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory exposure flaw has been discovered in Node.js. A flaw in Node.js\u0027s buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Nodejs uninitialized memory exposure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55131"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431350",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431350"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55131",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55131"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55131",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55131"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"
        }
      ],
      "release_date": "2026-01-20T20:41:55.591000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Nodejs uninitialized memory exposure"
    },
    {
      "cve": "CVE-2025-55132",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "discovery_date": "2026-01-20T21:01:12.192484+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A file access flaw has been discovered in NodeJS. A file\u0027s access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Nodejs filesystem permissions bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-55132"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-55132",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-55132"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-55132",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55132"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"
        }
      ],
      "release_date": "2026-01-20T20:41:55.620000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Nodejs filesystem permissions bypass"
    },
    {
      "cve": "CVE-2025-59464",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-20T21:01:52.581156+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A resource consumption flaw has been discovered in NodeJS. A memory leak in Node.js\u2019s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Nodejs memory leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-59464"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-59464",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-59464"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59464",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59464"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"
        }
      ],
      "release_date": "2026-01-20T20:41:55.599000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Nodejs memory leak"
    },
    {
      "cve": "CVE-2026-2950",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-03-31T20:01:38.424064+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453499"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Lodash. An attacker can exploit a prototype pollution vulnerability in the `_.unset` and `_.omit` functions by bypassing a security check. This bypass is achieved by providing array-wrapped path segments, which allows for the deletion of properties from built-in JavaScript prototypes such as `Object.prototype`. This could lead to unexpected application behavior or denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-2950"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453499",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453499"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-2950",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
          "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
        }
      ],
      "release_date": "2026-03-31T19:18:35.796000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass"
    },
    {
      "cve": "CVE-2026-6734",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "discovery_date": "2026-06-17T19:04:00.272340+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490024"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When using Socks5ProxyAgent, undici incorrectly reuses a single connection pool across different origins. This can lead to cross-origin request routing, where sensitive credentials and data intended for one destination are sent to another. Consequently, responses from unintended origins may be trusted, and secure HTTPS connections could be silently downgraded to unencrypted HTTP, resulting in information disclosure and data integrity issues.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important security flaw. The `undici` library, when configured with `Socks5ProxyAgent` to handle requests for multiple origins, incorrectly reuses connection pools. This can lead to sensitive data and credentials being misrouted to unintended destinations, potentially downgrading HTTPS connections to HTTP and compromising data integrity and confidentiality. Red Hat products utilizing `undici` with `Socks5ProxyAgent` in multi-origin scenarios are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490024",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490024"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6734"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj"
        }
      ],
      "release_date": "2026-06-17T16:36:55.439000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "The single most impactful mitigation is applying network egress controls to restrict which external destinations affected applications can reach. Because the vulnerability causes requests to be misrouted to wrong origins, limiting the set of reachable origins directly reduces the attack surface. These controls collectively limit the blast radius of the connection pool misrouting \u2014 the attacker must compromise one of the explicitly allowed destinations rather than any arbitrary origin \u2014 but they do not fix the underlying logic bug.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing"
    },
    {
      "cve": "CVE-2026-9697",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-06-17T19:03:30.813843+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490018"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When undici\u0027s ProxyAgent is configured with a SOCKS5 proxy Uniform Resource Identifier (URI), it silently ignores Transport Layer Security (TLS) options, such as custom Certificate Authorities (CAs). This allows a remote attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and tampering with HTTPS communications. The connection falls back to Node.js\u0027s default trust store, bypassing intended security configurations and potentially leading to information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability. Applications using `undici`\u0027s `ProxyAgent` with a SOCKS5 proxy URI will silently ignore user-configured TLS options, including custom Certificate Authorities. This bypasses intended security controls for HTTPS communication, enabling a remote attacker to perform Man-in-the-Middle attacks, potentially leading to information disclosure or arbitrary code execution in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9697"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490018",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490018"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9697",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9697"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9697",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9697"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g"
        }
      ],
      "release_date": "2026-06-17T16:46:42.706000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy"
    },
    {
      "cve": "CVE-2026-45149",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-29T21:02:00.092772+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483481"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a large numeric range for expansion. The library allocates excessive memory to generate all intermediate elements before applying the maximum limit, leading to high memory consumption and potential application crashes. This can impact the availability of systems using the library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs25-main@aarch64",
          "Red Hat Hardened Images:nodejs25-main@noarch",
          "Red Hat Hardened Images:nodejs25-main@src",
          "Red Hat Hardened Images:nodejs25-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483481",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483481"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2"
        }
      ],
      "release_date": "2026-05-29T19:55:07.337000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-10T13:03:00+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7378"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs25-main@aarch64",
            "Red Hat Hardened Images:nodejs25-main@noarch",
            "Red Hat Hardened Images:nodejs25-main@src",
            "Red Hat Hardened Images:nodejs25-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges"
    }
  ]
}