{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs24:\n  * nodejs24-24.18.1-0.1.hum1 (aarch64, x86_64)\n  * nodejs24-bin-24.18.1-0.1.hum1 (noarch)\n  * nodejs24-devel-24.18.1-0.1.hum1 (aarch64, x86_64)\n  * nodejs24-docs-24.18.1-0.1.hum1 (noarch)\n  * nodejs24-full-i18n-24.18.1-0.1.hum1 (aarch64, x86_64)\n  * nodejs24-libs-24.18.1-0.1.hum1 (aarch64, x86_64)\n  * nodejs24-npm-11.16.0-1.24.18.1.0.1.hum1 (noarch)\n  * nodejs24-npm-bin-24.18.1-0.1.hum1 (noarch)\n  * v8-13.6-devel-13.6.233.17-1.24.18.1.0.1.hum1 (aarch64, x86_64)\n  * nodejs24-24.18.1-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:48537",
        "url": "https://access.redhat.com/errata/RHSA-2026:48537"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58043",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58043"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56847",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56847"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56850",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58040",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16729",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13697",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13697"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15157",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15157"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14643",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14643"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16728",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16728"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58039",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48537.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-05T14:35:28+00:00",
      "generator": {
        "date": "2026-08-05T14:35:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:48537",
      "initial_release_date": "2026-07-30T03:14:48+00:00",
      "revision_history": [
        {
          "date": "2026-07-30T03:14:48+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T14:35:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@aarch64",
                "product": {
                  "name": "nodejs24-main@aarch64",
                  "product_id": "nodejs24-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.18.1-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@src",
                "product": {
                  "name": "nodejs24-main@src",
                  "product_id": "nodejs24-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.18.1-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@x86_64",
                "product": {
                  "name": "nodejs24-main@x86_64",
                  "product_id": "nodejs24-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24@24.18.1-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs24-main@noarch",
                "product": {
                  "name": "nodejs24-main@noarch",
                  "product_id": "nodejs24-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs24-bin@24.18.1-0.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@aarch64"
        },
        "product_reference": "nodejs24-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@noarch"
        },
        "product_reference": "nodejs24-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@src"
        },
        "product_reference": "nodejs24-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs24-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs24-main@x86_64"
        },
        "product_reference": "nodejs24-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13697",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-07-29T17:01:30.886442+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508485"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508485",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508485"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13697",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13697"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"
        }
      ],
      "release_date": "2026-07-29T16:32:39.519000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives"
    },
    {
      "cve": "CVE-2026-14643",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-07-29T22:00:55.488824+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508676"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in `no-cache` or `private` `Cache-Control` directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically, authenticated user data can be inadvertently served from the cache to a different, potentially unauthenticated, user if both requests resolve to the same cache key.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14643"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508676",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508676"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14643"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54"
        }
      ],
      "release_date": "2026-07-29T21:08:33.311000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing"
    },
    {
      "cve": "CVE-2026-15157",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-07-29T22:00:58.386985+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508677"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a `type` property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed (CRLF) sequences. This vulnerability enables the attacker to append arbitrary HTTP headers, potentially leading to the smuggling of a second request past the upstream server. This could result in limited information disclosure and integrity impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: HTTP header injection via unvalidated blob-like body type property",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15157"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508677",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508677"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15157",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15157"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15157",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15157"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5"
        }
      ],
      "release_date": "2026-07-29T21:17:44.740000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: HTTP header injection via unvalidated blob-like body type property"
    },
    {
      "cve": "CVE-2026-16728",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-07-29T22:01:01.514325+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508678"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici\u0027s retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to downstream applications, such as proxies or gateways, sending invalid HTTP responses, potentially causing response desynchronization, connection hangs, or data corruption for clients.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16728"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508678",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508678"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16728",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16728"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16728",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16728"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524"
        }
      ],
      "release_date": "2026-07-29T20:59:02.314000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length"
    },
    {
      "cve": "CVE-2026-56850",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-07-30T07:07:33.628354+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509179"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client\u0027s identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509179",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56850",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.074000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw"
    },
    {
      "cve": "CVE-2026-58039",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-07-31T01:00:57.616263+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Information disclosure due to improper permission enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured `--allow-fs-write` paths by triggering `process.report`. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.\n\nRed Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).\n\nSystems and applications that do not actively enable Node.js\u0027s experimental Permission Model flag (`--experimental-permission`), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability",
          "url": "https://nodejs.org/en/blog/vulnerability"
        }
      ],
      "release_date": "2026-07-31T00:18:49.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Information disclosure due to improper permission enforcement"
    },
    {
      "cve": "CVE-2026-58040",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "discovery_date": "2026-07-30T07:05:01.799571+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTPS Agent TLS session reuse skips hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session.\n\nApplications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs24-main@aarch64",
          "Red Hat Hardened Images:nodejs24-main@noarch",
          "Red Hat Hardened Images:nodejs24-main@src",
          "Red Hat Hardened Images:nodejs24-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:49.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T03:14:48+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48537"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs24-main@aarch64",
            "Red Hat Hardened Images:nodejs24-main@noarch",
            "Red Hat Hardened Images:nodejs24-main@src",
            "Red Hat Hardened Images:nodejs24-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTPS Agent TLS session reuse skips hostname verification"
    }
  ]
}