Vulnerability-Lookup

RHSA-2026:97802

Vulnerability from csaf_redhat - Published: 2026-11-10 16:44 - Updated: 2026-11-13 13:34

Summary

Red Hat Security Advisory: Red Hat Developer Hub 1.10.7 Plugin Catalog GA plugins release.

Severity

Important

Notes

Topic: Red Hat Developer Hub 1.10.7 Plugin Catalog GA plugins release.

Details: Red Hat Developer Hub (RHDH) is extensible by the plugins included herein.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-54404

A flaw was found in zod. A remote attacker can trigger a denial of service (DoS) by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element without a cap or early exit, the application consumes excessive memory and crashes due to an out-of-memory condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64	—	Vendor Fix fix Workaround

Known not affected 28 products

Product	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64	—	Workaround

Threats

Impact Important

CVE-2026-75838

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64		—	Vendor Fix fix Workaround

Known not affected 34 products

Product	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64	—	Workaround

Threats

Impact Moderate

CVE-2026-87018

A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64	—	Vendor Fix fix

Known not affected 31 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64		—
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64		—

Threats

Impact Important

CVE-2026-87029

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service (DoS) by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandled exception is produced that crashes the client application.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-248 - Uncaught Exception

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Moderate

CVE-2026-102276

A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64		—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64		—	Vendor Fix fix Workaround

Known not affected 33 products

Product	Version	Remediation
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64	—	Workaround
Unresolved product id: Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64	—	Workaround

Threats

Impact Important

CVE-2026-102278

A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 2 products, the same list as for CVE-2026-102276

Known not affected 33 products, the same list as for CVE-2026-102276

Threats

Impact Important

CVE-2026-109383

A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Important

CVE-2026-109829

A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-346 - Origin Validation Error

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Important

CVE-2026-109841

A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity (SRI) algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing it. A remote attacker who controls the HTTP response body can exploit this flaw to deliver modified content without triggering an integrity error, bypassing intended security protections.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-354 - Improper Validation of Integrity Check Value

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Moderate

CVE-2026-109869

A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-248 - Uncaught Exception

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Important

CVE-2026-109924

A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Moderate

CVE-2026-109932

A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client's automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-87018

Known not affected 31 products, the same list as for CVE-2026-87018

Threats

Impact Moderate

CVE-2026-113872

A flaw was found in multer. A remote attacker could cause a Denial of Service (DoS) by sending and abruptly aborting a file upload request when an asynchronous file filter is configured. When the aborted request's pending filter callback finishes, it triggers an unhandled stream error, leading to an application process crash.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-248 - Uncaught Exception

Affected products

Fixed 2 products, the same list as for CVE-2026-102276

Known not affected 33 products, the same list as for CVE-2026-102276

Threats

Impact Important

References

141 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:97802	self
https://access.redhat.com/security/cve/CVE-2023-54404	external
https://access.redhat.com/security/cve/CVE-2026-102276	external
https://access.redhat.com/security/cve/CVE-2026-102278	external
https://access.redhat.com/security/cve/CVE-2026-109383	external
https://access.redhat.com/security/cve/CVE-2026-109829	external
https://access.redhat.com/security/cve/CVE-2026-109841	external
https://access.redhat.com/security/cve/CVE-2026-109869	external
https://access.redhat.com/security/cve/CVE-2026-109924	external
https://access.redhat.com/security/cve/CVE-2026-109932	external
https://access.redhat.com/security/cve/CVE-2026-113872	external
https://access.redhat.com/security/cve/CVE-2026-75838	external
https://access.redhat.com/security/cve/CVE-2026-87018	external
https://access.redhat.com/security/cve/CVE-2026-87029	external
https://access.redhat.com/security/updates/classi…	external
https://catalog.redhat.com/search?gs&searchType=c…	external
https://developers.redhat.com/rhdh/overview	external
https://docs.redhat.com/en/documentation/red_hat_…	external
https://redhat.atlassian.net/browse/RHIDP-16569	external
https://redhat.atlassian.net/browse/RHIDP-17506	external
https://redhat.atlassian.net/browse/RHIDP-17509	external
https://redhat.atlassian.net/browse/RHIDP-17510	external
https://redhat.atlassian.net/browse/RHIDP-17511	external
https://redhat.atlassian.net/browse/RHIDP-17512	external
https://redhat.atlassian.net/browse/RHIDP-17513	external
https://redhat.atlassian.net/browse/RHIDP-17514	external
https://redhat.atlassian.net/browse/RHIDP-17843	external
https://redhat.atlassian.net/browse/RHIDP-17844	external
https://redhat.atlassian.net/browse/RHIDP-17852	external
https://redhat.atlassian.net/browse/RHIDP-17854	external
https://redhat.atlassian.net/browse/RHIDP-17994	external
https://redhat.atlassian.net/browse/RHIDP-17995	external
https://redhat.atlassian.net/browse/RHIDP-17996	external
https://redhat.atlassian.net/browse/RHIDP-17997	external
https://redhat.atlassian.net/browse/RHIDP-18000	external
https://redhat.atlassian.net/browse/RHIDP-18001	external
https://redhat.atlassian.net/browse/RHIDP-18002	external
https://redhat.atlassian.net/browse/RHIDP-18003	external
https://redhat.atlassian.net/browse/RHIDP-18006	external
https://redhat.atlassian.net/browse/RHIDP-18007	external
https://redhat.atlassian.net/browse/RHIDP-18008	external
https://redhat.atlassian.net/browse/RHIDP-18009	external
https://redhat.atlassian.net/browse/RHIDP-18012	external
https://redhat.atlassian.net/browse/RHIDP-18013	external
https://redhat.atlassian.net/browse/RHIDP-18014	external
https://redhat.atlassian.net/browse/RHIDP-18015	external
https://redhat.atlassian.net/browse/RHIDP-18028	external
https://redhat.atlassian.net/browse/RHIDP-18029	external
https://redhat.atlassian.net/browse/RHIDP-18030	external
https://redhat.atlassian.net/browse/RHIDP-18033	external
https://redhat.atlassian.net/browse/RHIDP-18034	external
https://redhat.atlassian.net/browse/RHIDP-18035	external
https://redhat.atlassian.net/browse/RHIDP-18036	external
https://redhat.atlassian.net/browse/RHIDP-18037	external
https://redhat.atlassian.net/browse/RHIDP-18040	external
https://redhat.atlassian.net/browse/RHIDP-18041	external
https://redhat.atlassian.net/browse/RHIDP-18042	external
https://redhat.atlassian.net/browse/RHIDP-18043	external
https://redhat.atlassian.net/browse/RHIDP-18046	external
https://redhat.atlassian.net/browse/RHIDP-18047	external
https://redhat.atlassian.net/browse/RHIDP-18048	external
https://redhat.atlassian.net/browse/RHIDP-18049	external
https://redhat.atlassian.net/browse/RHIDP-18210	external
https://redhat.atlassian.net/browse/RHIDP-18211	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-54404	self
https://www.cve.org/CVERecord?id=CVE-2023-54404	external
https://access.redhat.com/security/cve/CVE-2026-75838	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517772	external
https://www.cve.org/CVERecord?id=CVE-2026-75838	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75838	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-87018	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553677	external
https://www.cve.org/CVERecord?id=CVE-2026-87018	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87018	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-87029	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553726	external
https://www.cve.org/CVERecord?id=CVE-2026-87029	external
https://nvd.nist.gov/vuln/detail/CVE-2026-87029	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-102276	self
https://bugzilla.redhat.com/show_bug.cgi?id=2542707	external
https://www.cve.org/CVERecord?id=CVE-2026-102276	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102276	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/s…	external
https://access.redhat.com/security/cve/CVE-2026-102278	self
https://bugzilla.redhat.com/show_bug.cgi?id=2542700	external
https://www.cve.org/CVERecord?id=CVE-2026-102278	external
https://nvd.nist.gov/vuln/detail/CVE-2026-102278	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/c…	external
https://github.com/juliangruber/brace-expansion/s…	external
https://access.redhat.com/security/cve/CVE-2026-109383	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553678	external
https://www.cve.org/CVERecord?id=CVE-2026-109383	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109383	external
https://github.com/nodejs/undici/commit/f75eac00ac17	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-109829	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553679	external
https://www.cve.org/CVERecord?id=CVE-2026-109829	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109829	external
https://github.com/nodejs/undici/commit/26c2bfb3def0	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-109841	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553669	external
https://www.cve.org/CVERecord?id=CVE-2026-109841	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109841	external
https://github.com/nodejs/undici/commit/4f7ef6806e53	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-109869	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553656	external
https://www.cve.org/CVERecord?id=CVE-2026-109869	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109869	external
https://github.com/nodejs/undici/commit/b5084c7dc239	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-109924	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553663	external
https://www.cve.org/CVERecord?id=CVE-2026-109924	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109924	external
https://github.com/nodejs/undici/commit/789ef26461c	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-109932	self
https://bugzilla.redhat.com/show_bug.cgi?id=2553687	external
https://www.cve.org/CVERecord?id=CVE-2026-109932	external
https://nvd.nist.gov/vuln/detail/CVE-2026-109932	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-113872	self
https://bugzilla.redhat.com/show_bug.cgi?id=2559046	external
https://www.cve.org/CVERecord?id=CVE-2026-113872	external
https://nvd.nist.gov/vuln/detail/CVE-2026-113872	external
https://github.com/expressjs/multer/security/advi…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Developer Hub 1.10.7 Plugin Catalog GA plugins release.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Developer Hub (RHDH) is extensible by the plugins included herein.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:97802",
        "url": "https://access.redhat.com/errata/RHSA-2026:97802"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-54404",
        "url": "https://access.redhat.com/security/cve/CVE-2023-54404"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102276",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-102278",
        "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-109383",
        "url": "https://access.redhat.com/security/cve/CVE-2026-109383"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-109829",
        "url": "https://access.redhat.com/security/cve/CVE-2026-109829"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-109841",
        "url": "https://access.redhat.com/security/cve/CVE-2026-109841"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-109869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-109869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-109924",
        "url": "https://access.redhat.com/security/cve/CVE-2026-109924"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-109932",
        "url": "https://access.redhat.com/security/cve/CVE-2026-109932"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-113872",
        "url": "https://access.redhat.com/security/cve/CVE-2026-113872"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75838",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75838"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-87018",
        "url": "https://access.redhat.com/security/cve/CVE-2026-87018"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-87029",
        "url": "https://access.redhat.com/security/cve/CVE-2026-87029"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh",
        "url": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh"
      },
      {
        "category": "external",
        "summary": "https://developers.redhat.com/rhdh/overview",
        "url": "https://developers.redhat.com/rhdh/overview"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub",
        "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-16569",
        "url": "https://redhat.atlassian.net/browse/RHIDP-16569"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17506",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17506"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17509",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17509"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17510",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17510"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17511",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17511"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17512",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17512"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17513",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17513"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17514",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17514"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17843",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17843"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17844",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17844"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17852",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17852"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17854",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17854"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17994",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17994"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17995",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17995"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17996",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17996"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-17997",
        "url": "https://redhat.atlassian.net/browse/RHIDP-17997"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18000",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18000"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18001",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18001"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18002",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18002"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18003",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18003"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18006",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18006"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18007",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18007"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18008",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18008"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18009",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18009"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18012",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18012"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18013",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18013"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18014",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18014"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18015",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18015"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18028",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18028"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18029",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18029"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18030",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18030"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18033",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18033"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18034",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18034"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18035",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18035"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18036",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18036"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18037",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18037"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18040",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18040"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18041",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18041"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18042",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18042"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18043",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18043"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18046",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18046"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18047",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18047"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18048",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18048"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18049",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18049"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18210",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18210"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-18211",
        "url": "https://redhat.atlassian.net/browse/RHIDP-18211"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97802.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Developer Hub 1.10.7 Plugin Catalog GA plugins release.",
    "tracking": {
      "current_release_date": "2026-11-13T13:34:13+00:00",
      "generator": {
        "date": "2026-11-13T13:34:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:97802",
      "initial_release_date": "2026-11-10T16:44:09+00:00",
      "revision_history": [
        {
          "date": "2026-11-10T16:44:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-10T16:44:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T13:34:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Hub 1.10",
                "product": {
                  "name": "Red Hat Developer Hub 1.10",
                  "product_id": "Red Hat Developer Hub 1.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhdh:1.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-analytics-provider-segment@sha256%3Abb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment\u0026tag=1794281850"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-catalog-backend-module-keycloak@sha256%3Aeaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak\u0026tag=1794281950"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-rbac@sha256%3Acf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-rbac\u0026tag=1794281980"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256%3A7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes\u0026tag=1794280928"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-scaffolder-backend-module-regex@sha256%3A2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex\u0026tag=1794280785"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-tech-radar@sha256%3Acd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-tech-radar\u0026tag=1794282027"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-tech-radar-backend@sha256%3Adc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend\u0026tag=1794281950"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-community-plugin-topology@sha256%3A688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-community-plugin-topology\u0026tag=1794282098"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-catalog-backend-module-github@sha256%3A26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github\u0026tag=1794280859"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-catalog-backend-module-github-org@sha256%3Ad04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org\u0026tag=1794281100"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-catalog-backend-module-gitlab@sha256%3A9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab\u0026tag=1794280999"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-catalog-backend-module-gitlab-org@sha256%3A0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org\u0026tag=1794280937"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-catalog-backend-module-ldap@sha256%3A83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap\u0026tag=1794282031"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-catalog-backend-module-msgraph@sha256%3A882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph\u0026tag=1794283742"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-kubernetes-backend@sha256%3Adefac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend\u0026tag=1794280838"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-scaffolder-backend-module-github@sha256%3A8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github\u0026tag=1794281066"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-signals-backend@sha256%3Af46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-signals-backend\u0026tag=1794282079"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-techdocs@sha256%3Abff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-techdocs\u0026tag=1794281190"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-techdocs-backend@sha256%3A4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-techdocs-backend\u0026tag=1794281978"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
                  "product_id": "registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/backstage-plugin-techdocs-module-addons-contrib@sha256%3Ad130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib\u0026tag=1794281061"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256%3Aeb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights\u0026tag=1794280872"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256%3A381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend\u0026tag=1794282003"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256%3A774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights\u0026tag=1794281437"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256%3Aa80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page\u0026tag=1794281010"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256%3A7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button\u0026tag=1794280993"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-global-header@sha256%3A2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header\u0026tag=1794281941"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed@sha256%3A8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed\u0026tag=1794320804"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256%3Ab919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend\u0026tag=1794320752"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator@sha256%3A3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator\u0026tag=1794310895"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256%3A662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend\u0026tag=1794311285"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256%3A9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki\u0026tag=1794311457"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256%3A7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets\u0026tag=1794311047"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-quickstart@sha256%3A43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart\u0026tag=1794281858"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256%3A9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator\u0026tag=1794311267"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64",
                  "product_id": "registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/roadiehq-scaffolder-backend-module-http-request@sha256%3A9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request\u0026tag=1794281830"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-54404",
      "discovery_date": "2026-10-01T23:11:56.681434+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in zod. A remote attacker can trigger a denial of service (DoS) by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element without a cap or early exit, the application consumes excessive memory and crashes due to an out-of-memory condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "This vulnerability is evaluated with an Important severity because remote attackers can induce complete service unavailability through process termination without requiring privileged access. Within Red Hat environments, the affected library is embedded into multiple management consoles and microservices that process structured user data. The operational impact depends on whether exposed network endpoints evaluate untrusted collections without preliminary restrictions on payload sizes or element counts.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-54404"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-54404",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-54404"
        }
      ],
      "release_date": "2026-10-01T17:11:13.762000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "zod: zod: Denial of service via unbounded array validation"
    },
    {
      "cve": "CVE-2026-75838",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-08-18T11:32:11.523560+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517772"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This cross-site scripting flaw in DOMPurify affects Red Hat products that utilize the library for HTML sanitization. The vulnerability allows attackers to execute arbitrary JavaScript by exploiting incomplete neutralization of detached subtrees during IN_PLACE sanitization, but only when a non-default configuration involving an element-removal hook is in use and user interaction with specially crafted content occurs.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517772",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517772"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75838",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75838",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook"
        }
      ],
      "release_date": "2026-08-18T11:19:47.885000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization"
    },
    {
      "cve": "CVE-2026-87018",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-10-15T18:45:26.683580+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553677"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87018"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553677",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553677"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87018"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87018"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"
        }
      ],
      "release_date": "2026-10-15T18:38:25.613000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate"
    },
    {
      "cve": "CVE-2026-87029",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-15T19:23:21.481772+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service (DoS) by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandled exception is produced that crashes the client application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unhandled exception in decompress interceptor",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because successful exploitation requires an application to connect to an untrusted or compromised HTTP server and utilize a specific client interceptor configuration. A denial of service condition only occurs when the decompression interceptor is composed with a downstream handler that throws errors upon receiving oversized responses. Standard Red Hat environments that connect exclusively to trusted endpoints or run default HTTP pipelines without this specific combination of interceptors are not susceptible to this failure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87029"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87029",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87029"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87029",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87029"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6"
        }
      ],
      "release_date": "2026-10-15T18:48:36.902000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via unhandled exception in decompress interceptor"
    },
    {
      "cve": "CVE-2026-102276",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:02:20.910434+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542707"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542707",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
          "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
          "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
        }
      ],
      "release_date": "2026-09-28T20:50:59.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
    },
    {
      "cve": "CVE-2026-102278",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-09-28T21:00:55.949756+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2542700"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "RHBZ#2542700",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
          "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
          "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
        }
      ],
      "release_date": "2026-09-28T20:57:09.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
    },
    {
      "cve": "CVE-2026-109383",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-15T18:45:43.553803+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553678"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Certificate validation bypass via dropped TLS options in Agent",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109383"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553678",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553678"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109383",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109383"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109383"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/f75eac00ac17",
          "url": "https://github.com/nodejs/undici/commit/f75eac00ac17"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"
        }
      ],
      "release_date": "2026-10-15T18:34:01.468000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Certificate validation bypass via dropped TLS options in Agent"
    },
    {
      "cve": "CVE-2026-109829",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-10-15T18:45:59.990034+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553679"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because successful exploitation enables remote attackers to achieve shared cache poisoning and unauthorized cross-user data exposure across network boundaries without requiring elevated privileges. Within Red Hat environments shipping Node.js runtimes and associated container services, undici is utilized as an HTTP client backend. However, exploitation requires a specific application architecture where an originless dispatcher chains redirect processing ahead of a shared cache store, rather than the default standalone client configurations. Deployments that do not implement shared caching across multi-origin redirect flows or that isolate cache storage per origin remain unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109829"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553679",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553679"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109829",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109829"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109829",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109829"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/26c2bfb3def0",
          "url": "https://github.com/nodejs/undici/commit/26c2bfb3def0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"
        }
      ],
      "release_date": "2026-10-15T18:28:04.954000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching"
    },
    {
      "cve": "CVE-2026-109841",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-10-15T18:42:19.338403+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553669"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity (SRI) algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing it. A remote attacker who controls the HTTP response body can exploit this flaw to deliver modified content without triggering an integrity error, bypassing intended security protections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat environments, this vulnerability is rated as Moderate impact because successful exploitation requires an adversary capable of tampering with network responses alongside the uncommon prerequisite that an application explicitly configured non-lowercase hashing algorithms for Subresource Integrity checks. Standard deployments typically employ lowercase digest names, which properly enforce validation and prevent bypass. Furthermore, the issue is constrained to compromising response integrity when client workloads rely on undici\u0027s fetch implementation under these specific naming conditions, without directly leading to system compromise or arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109841"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553669",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553669"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109841",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109841"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109841",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109841"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/4f7ef6806e53",
          "url": "https://github.com/nodejs/undici/commit/4f7ef6806e53"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"
        }
      ],
      "release_date": "2026-10-15T18:22:06.283000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens"
    },
    {
      "cve": "CVE-2026-109869",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-15T18:31:39.700754+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109869"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/b5084c7dc239",
          "url": "https://github.com/nodejs/undici/commit/b5084c7dc239"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"
        }
      ],
      "release_date": "2026-10-15T18:08:31.243000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service via unhandled stream error on excessive content encodings"
    },
    {
      "cve": "CVE-2026-109924",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-15T18:34:33.100871+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553663"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A malicious server can trigger a Denial of Service (DoS) by exhausting application memory. When an application connects to an untrusted Server-Sent Events (SSE) feed, the EventSource parser does not properly limit retained internal state when processing fragmented lines or repeated message fields. This allows an attacker to send crafted or compressed responses that consume excessive memory and terminate the application process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via memory exhaustion in EventSource client",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate rather than Important because exploitation requires a Node.js client application to actively connect to an untrusted or compromised Server-Sent Events endpoint. In standard Red Hat product deployments, applications typically consume trusted, internal network services rather than arbitrary external feeds. Additionally, the impact is strictly confined to process termination from resource exhaustion, with no compromise to data confidentiality or system integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109924"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553663",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553663"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109924",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109924"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109924",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109924"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/commit/789ef26461c",
          "url": "https://github.com/nodejs/undici/commit/789ef26461c"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"
        }
      ],
      "release_date": "2026-10-15T18:16:48.452000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via memory exhaustion in EventSource client"
    },
    {
      "cve": "CVE-2026-109932",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-15T19:02:19.103535+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553687"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A malicious or compromised WebSocket server can trigger a Denial of Service (DoS) by repeatedly sending small PING messages while refusing to read the client\u0027s automated replies. Because the client ignores flow-control signals when writing responses to the network socket, unread messages accumulate indefinitely in memory. This unchecked memory consumption can exhaust available system memory and cause the application process to terminate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires an affected client application to initiate an outbound WebSocket connection to a malicious or compromised remote endpoint, rather than being exposed on inbound service ports. In typical Red Hat environments, Node.js workloads communicate with trusted internal services, limiting the likelihood of interacting with hostile endpoints. Additionally, the blast radius is confined to process crashes resulting from memory exhaustion, with no compromise of data confidentiality or integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-109932"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553687",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553687"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-109932",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109932"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-109932",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109932"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"
        }
      ],
      "release_date": "2026-10-15T18:44:22.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici: Denial of Service via unbounded WebSocket PONG buffering"
    },
    {
      "cve": "CVE-2026-113872",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-10-22T14:31:26.650110+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2559046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multer. A remote attacker could cause a Denial of Service (DoS) by sending and abruptly aborting a file upload request when an asynchronous file filter is configured. When the aborted request\u0027s pending filter callback finishes, it triggers an unhandled stream error, leading to an application process crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: multer: Denial of Service via aborted request during asynchronous file filtering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger an unhandled exception that terminates the Node.js application process with a single aborted request, causing a complete denial of service. Within Red Hat environments hosting services built on Node.js, the issue only manifests if endpoints implement custom asynchronous file filters during multipart upload handling. Systems that rely on synchronous file filters or default upload configurations remain unaffected. Although container orchestration platforms may automatically restart failed service pods, repeated exploitation could sustain an availability outage.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-113872"
        },
        {
          "category": "external",
          "summary": "RHBZ#2559046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559046"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-113872",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-113872"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-113872",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113872"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"
        }
      ],
      "release_date": "2026-10-22T14:20:18.363000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-10T16:44:09+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:97802"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-analytics-provider-segment@sha256:bb134bb8261c7b3943b990793da085c31b45a7f3641891505f17f11b3143fd50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak@sha256:eaf978c3c9c52b49d6d32189a7b12988ce7736a3aa0f34b546c2a6626a350293_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-rbac@sha256:cf5290694c0166db411f123938a01715a32122b96f9e3ca832a45c22909850be_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-kubernetes@sha256:7d9d6d4c5c3eb1c53887f9882e4fbb0d95128e045d66285478a11100801b2c50_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-scaffolder-backend-module-regex@sha256:2bd8fb9e3b4420bcd1371740ff0eae060f4d4f5ca6d67ac809bcb700223888bd_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar-backend@sha256:dc8b8a370aed83efa139e69cdc7b6042d631960d4b6b2e16176fc196c5e092eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-tech-radar@sha256:cd1ccac82a7c65b8ecac190e040de564fd49eb1efc21e6671477dfa3e6a514d7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-community-plugin-topology@sha256:688adab0ec8955db9fa24b79caed09a02b435da46117e31d492c6dab93a18602_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github-org@sha256:d04f3c072ce7b784cd7e91c0ec97eb63593bdef5f9fa59b01d6ce9fb7084ac87_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-github@sha256:26e0b43359413563b6d27fadbc6fbc6cbde1721d33388b253904517027741e41_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab-org@sha256:0611d9cdca23244c1eb219d3b1fcc7e7362716c6e7608d97e5209e14b68ec096_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-gitlab@sha256:9d221154ce05af136c95712711e7bb057845beb64b3dd53487ba609e36bef4eb_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-ldap@sha256:83bb683250645fe1e52a502d7a4591ee4a108b74500af5a789206e68b4ca60d4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-catalog-backend-module-msgraph@sha256:882ea8be52fc10c2c9971d7c6d3b0435a5eeca2a64da199814df2f5f71c55bd8_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-kubernetes-backend@sha256:defac3676bf11ce22b51dbce540a875f8c55d8f1bb0dcda5a64a347a066c15c4_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-scaffolder-backend-module-github@sha256:8cb34c55ac5181c870f58d3ca512c582b6c347e91ff33f9e1a14dc1251d4d14c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-signals-backend@sha256:f46cfadf9b7eb5f64bcdabd80b52c0f64fb6cc63af614aaeffaa1c2e7be94a8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-backend@sha256:4240d9ac1c375d82f5a7e133f1503f74655c2051525874a333891dc5ce66df4c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs-module-addons-contrib@sha256:d130b16ac8faa8aab4e8331e10345ffa7b872c4b6ded8351cd86d374d9f7ec8c_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/backstage-plugin-techdocs@sha256:bff99dd3e256d2e4d14e148b20ee38d6fa8197b1fc3ac692b7f5816735750d3e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights-backend@sha256:381cc88bc8e32db987a0d4a6f62338e5d83bfdd50c731e540a1f2a88d0a7c3d2_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-adoption-insights@sha256:eb2215f01e6b1c82ec119f4e85cb13a64545a9bb8eea3a7a7353bcb3a3fad330_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights@sha256:774217cb3ad5594e9653040a20ec818db199aa375f283d896abcdc29e8bdda36_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-dynamic-home-page@sha256:a80aae32472124d064bf13c2eb1e2a49a912e5d6fbaf6e9a0c5ba205197422a7_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-floating-action-button@sha256:7a28e7ad9804a5f84d8e9df4dbf1ae0d0b32e8dc5899f0c0ac7105626021b4fc_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-global-header@sha256:2260c9941d11b18291c8c3261d5cbadac6b1123c3ebf1ddb316528031e1aba9f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:b919db343bbdb49aea2cd697f2945d36af30f6acd9b162a721ee0469240ef468_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:8b97c1b3fe6b5a2f6d72980dde7f22d2385b3204cd1e4741a0c4106110355a0f_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9387b451b894135dacd7ad7f6ec9d1dedf2ee020b6e530bae29add404a13718d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:662b86fd5ac86b06ae5bcec5b92052f4a0cc5f8cd7d976d956b9b0808690dd09_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:7dd0021777fc969951e05b837cc648bba1bb10bd0ba5ea8565b33eafe32d4728_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:3c15b2c1295614642606d27cc06e0cf3e9e0f9d19c6630f5d2e7c80dfa3a5c08_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-quickstart@sha256:43fd2969a0a012a64a7696737a33114d7cc21e28358c37e8534c11f3fec87c79_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:9e6dca6c5c42dfa88824b74af5c374b4e8e8ce70e63762cdb33505f4f7f51ca6_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/roadiehq-scaffolder-backend-module-http-request@sha256:9c0ee03add278b4e5a085e5cef5e9aca9aea0d6fc1f37cec0c3e6fd6bb21e007_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: multer: Denial of Service via aborted request during asynchronous file filtering"
    }
  ]
}

CVE-2023-54404 (GCVE-0-2023-54404)

Vulnerability from cvelistv5 – Published: 2026-10-01 17:11 – Updated: 2026-10-28 21:17

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-10-28T21:17:22.423Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod."
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod."
        }
      ],
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-54404",
    "datePublished": "2026-10-01T17:11:13.762Z",
    "dateRejected": "2026-10-28T21:17:22.423Z",
    "dateReserved": "2026-10-01T17:10:41.641Z",
    "dateUpdated": "2026-10-28T21:17:22.423Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102276 (GCVE-0-2026-102276)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:50 – Updated: 2026-09-29 13:38

Title

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 13:37 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7885 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/juliangruber/brace-expansion/s…	x_refsource_CONFIRM
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: >= 4.0.0, < 5.0.10 Affected: >= 3.0.0, < 3.0.7 Affected: >= 2.0.0, < 2.1.5 Affected: < 1.1.19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102276",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T13:37:06.086529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T13:38:29.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.5"
            },
            {
              "status": "affected",
              "version": "\u003c 1.1.19"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:50:59.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
        }
      ],
      "source": {
        "advisory": "GHSA-6j4f-fj2g-mc7p",
        "discovery": "UNKNOWN"
      },
      "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102276",
    "datePublished": "2026-09-28T20:50:59.984Z",
    "dateReserved": "2026-09-28T20:11:16.658Z",
    "dateUpdated": "2026-09-29T13:38:29.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102278 (GCVE-0-2026-102278)

Vulnerability from cvelistv5 – Published: 2026-09-28 20:57 – Updated: 2026-10-01 15:02

Title

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 15:02 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7885 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/juliangruber/brace-expansion/s…	x_refsource_CONFIRM
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC
https://github.com/juliangruber/brace-expansion/c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
juliangruber	brace-expansion	Affected: >= 4.0.0, < 5.0.11 Affected: >= 3.0.0, < 3.0.8 Affected: >= 2.0.0, < 2.1.6 Affected: < 1.1.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T15:02:35.975978Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T15:02:44.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "juliangruber",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 5.0.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.0.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.1.6"
            },
            {
              "status": "affected",
              "version": "\u003c 1.1.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:57:09.850Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
        },
        {
          "name": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
        }
      ],
      "source": {
        "advisory": "GHSA-qhr7-859c-m2p7",
        "discovery": "UNKNOWN"
      },
      "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102278",
    "datePublished": "2026-09-28T20:57:09.850Z",
    "dateReserved": "2026-09-28T20:11:16.659Z",
    "dateUpdated": "2026-10-01T15:02:44.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109383 (GCVE-0-2026-109383)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:34 – Updated: 2026-10-16 20:03

Title

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

Summary

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node's default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 20:03 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 4.0.0 , < 6.29.1 (semver) Unaffected: 6.29.1 (semver) Affected: 7.0.0 , < 7.30.1 (semver) Unaffected: 7.30.1 (semver) Affected: 8.0.0 , < 8.12.2 (semver) Unaffected: 8.12.2 (semver)

Credits

euriconicacio mcollina UlisesGascon BlueN0r ksanjeev284

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109383",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T20:03:13.245340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T20:03:30.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.29.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.30.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.30.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.12.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "euriconicacio"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "BlueN0r"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "ksanjeev284"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node\u0027s default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls."
            }
          ],
          "value": "undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped before it reaches the TLS layer. As a result, a TLS peer whose certificate a custom checkServerIdentity was written to reject, but which passes Node\u0027s default hostname and chain checks, is silently accepted. Because Agent is the default dispatcher behind request, fetch, and setGlobalDispatcher, this affects the path most applications use, and EnvHttpProxyAgent is affected on its direct and no-proxy routes as well, while only applications that pass a function-valued tls option such as a custom checkServerIdentity for certificate or public-key pinning are at risk. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which preserve the tls option outside the JSON clone so custom verification callbacks are forwarded unchanged, and users should upgrade to one of those versions or later. As a workaround, pass the TLS options through connect instead of tls, or for proxied destinations use requestTls and proxyTls."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:34:01.468Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-109383",
    "datePublished": "2026-10-15T18:34:01.468Z",
    "dateReserved": "2026-10-12T14:29:57.987Z",
    "dateUpdated": "2026-10-16T20:03:30.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109829 (GCVE-0-2026-109829)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:28 – Updated: 2026-10-16 20:04

Title

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

Summary

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 20:03 UTC

CWE

CWE-346 - Origin Validation Error
CWE-524 - Use of Cache Containing Sensitive Information

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 7.0.0 , < 7.30.1 (semver) Unaffected: 7.30.1 (semver) Affected: 8.0.0 , < 8.12.2 (semver) Unaffected: 8.12.2 (semver)

Credits

Kushalkhemka mayank-jangid-moon opensec-intelligence bengsky13 mcollina UlisesGascon skigeek16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109829",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T20:03:57.700768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T20:04:09.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "7.30.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.30.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.12.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "opensec-intelligence"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "bengsky13"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop\u0027s cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests."
            }
          ],
          "value": "undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop\u0027s cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-524",
              "description": "CWE-524: Use of Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:28:04.954Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-109829",
    "datePublished": "2026-10-15T18:28:04.954Z",
    "dateReserved": "2026-10-13T05:47:05.596Z",
    "dateUpdated": "2026-10-16T20:04:09.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109841 (GCVE-0-2026-109841)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:22 – Updated: 2026-10-16 20:04

Title

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Summary

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 20:04 UTC

CWE

CWE-178 - Improper Handling of Case Sensitivity

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 7.15.0 , < 7.30.1 (semver) Unaffected: 7.30.1 (semver) Affected: 8.0.0 , < 8.12.2 (semver) Unaffected: 8.12.2 (semver)

Credits

Kushalkhemka mayank-jangid-moon opensec-intelligence mcollina UlisesGascon skigeek16 KhafraDev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109841",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T20:04:31.429219Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T20:04:41.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "7.30.1",
              "status": "affected",
              "version": "7.15.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.30.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.12.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kushalkhemka"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "mayank-jangid-moon"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "opensec-intelligence"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "skigeek16"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "KhafraDev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata."
            }
          ],
          "value": "undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-178",
              "description": "CWE-178: Improper Handling of Case Sensitivity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:22:06.283Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-109841",
    "datePublished": "2026-10-15T18:22:06.283Z",
    "dateReserved": "2026-10-13T07:02:52.591Z",
    "dateUpdated": "2026-10-16T20:04:41.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109869 (GCVE-0-2026-109869)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:08 – Updated: 2026-10-16 20:06

Title

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

Summary

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 20:05 UTC

CWE

CWE-248 - Uncaught Exception
CWE-459 - Incomplete Cleanup

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 6.23.0 , < 6.29.1 (semver) Unaffected: 6.29.1 (semver) Affected: 7.18.0 , < 7.30.1 (semver) Unaffected: 7.30.1 (semver) Affected: 8.0.0 , < 8.12.2 (semver) Unaffected: 8.12.2 (semver)

Credits

hanityx mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T20:05:44.033842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T20:06:00.782Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.29.1",
              "status": "affected",
              "version": "6.23.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.30.1",
              "status": "affected",
              "version": "7.18.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.30.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.12.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "hanityx"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."
            }
          ],
          "value": "undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses because of a content-encoding limit, but it created the internal response stream before that check and returned without attaching an error listener or aborting the request, so the early close surfaces a content-length mismatch on the orphaned stream, which Node.js treats as an unhandled error and terminates the process. A remote, unauthenticated server can trigger this with a single response, even when the application correctly catches the fetch() rejection, resulting in a denial of service. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. There is no workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459: Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:08:31.243Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Denial of Service via unhandled error on excessive content-encodings",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-109869",
    "datePublished": "2026-10-15T18:08:31.243Z",
    "dateReserved": "2026-10-13T08:52:10.454Z",
    "dateUpdated": "2026-10-16T20:06:00.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109924 (GCVE-0-2026-109924)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:16 – Updated: 2026-10-16 20:05

Title

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Summary

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 20:05 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 6.5.0 , < 6.29.1 (semver) Unaffected: 6.29.1 (semver) Affected: 7.0.0 , < 7.30.1 (semver) Unaffected: 7.30.1 (semver) Affected: 8.0.0 , < 8.12.2 (semver) Unaffected: 8.12.2 (semver)

Credits

iamibi mcollina UlisesGascon KhafraDev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109924",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T20:05:08.940657Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T20:05:22.386Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.29.1",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.30.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.30.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.12.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "iamibi"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "KhafraDev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."
            }
          ],
          "value": "undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing amount of per-field and per-chunk state that the byte-based maxEventSize and maxResponseSize limits do not bound, and because maxResponseSize is enforced on the compressed body before decompression, a small compressed response can expand into enough retained memory to terminate the process. An application only needs to maintain an EventSource connection to an untrusted peer, which controls only the response, and availability is the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which bound the retained parser state independently of the byte limits, and users should upgrade to one of those versions or later. There is no workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:16:48.452Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Denial of Service via unbounded memory in the EventSource parser",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-109924",
    "datePublished": "2026-10-15T18:16:48.452Z",
    "dateReserved": "2026-10-13T10:00:53.642Z",
    "dateUpdated": "2026-10-16T20:05:22.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109932 (GCVE-0-2026-109932)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:44 – Updated: 2026-10-16 20:00

Title

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

Summary

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client's PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 20:00 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-405 - Asymmetric Resource Consumption (Amplification)
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 5.15.0 , < 6.29.1 (semver) Unaffected: 6.29.1 (semver) Affected: 7.0.0 , < 7.30.1 (semver) Unaffected: 7.30.1 (semver) Affected: 8.0.0 , < 8.12.2 (semver) Unaffected: 8.12.2 (semver)

Credits

benzdeus UlisesGascon mcollina

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109932",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T20:00:14.787878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T20:00:38.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.29.1",
              "status": "affected",
              "version": "5.15.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.29.1",
              "versionType": "semver"
            },
            {
              "lessThan": "7.30.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.30.1",
              "versionType": "semver"
            },
            {
              "lessThan": "8.12.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "benzdeus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "mcollina"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client\u0027s PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround."
            }
          ],
          "value": "undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame received, the client automatically writes a PONG response and ignores the backpressure signal from the socket write, so a server that streams small PING frames while never reading the client\u0027s PONGs makes the outbound write queue and heap grow without bound until the Node.js process runs out of memory and terminates. The attack is remote and unauthenticated, needs only a normal WebSocket connection, and is asymmetric, since small inbound PINGs produce a much larger retained outbound queue, with availability the only impact. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, which pause WebSocket frame parsing when the automatic PONG response hits socket backpressure and resume on drain, bounding the outbound queue, and users should upgrade to one of those versions or later. There is no workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-405",
              "description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:44:22.571Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-109932",
    "datePublished": "2026-10-15T18:44:22.571Z",
    "dateReserved": "2026-10-13T11:00:00.833Z",
    "dateUpdated": "2026-10-16T20:00:38.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113872 (GCVE-0-2026-113872)

Vulnerability from cvelistv5 – Published: 2026-10-22 14:20 – Updated: 2026-10-22 19:00

Title

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

Summary

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-22 18:26 UTC

CWE

CWE-248 - Uncaught Exception
CWE-404 - Improper Resource Shutdown or Release

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/expressjs/multer/security/advi…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
multer	multer	Affected: 2.0.0 , < 2.5.0 (semver) Unaffected: 2.5.0 (semver)

Credits

santihabib UlisesGascon bjohansebas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-22T18:26:56.734787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-22T19:00:31.884Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/multer",
          "product": "multer",
          "vendor": "multer",
          "versions": [
            {
              "lessThan": "2.5.0",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "santihabib"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "bjohansebas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file\u0027s asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter."
            }
          ],
          "value": "multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file\u0027s asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "CWE-404: Improper Resource Shutdown or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T14:20:18.363Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-113872",
    "datePublished": "2026-10-22T14:20:18.363Z",
    "dateReserved": "2026-10-20T19:59:25.159Z",
    "dateUpdated": "2026-10-22T19:00:31.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:97802

CVE-2023-54404 (GCVE-0-2023-54404)

CVE-2026-102276 (GCVE-0-2026-102276)

CVE-2026-102278 (GCVE-0-2026-102278)

CVE-2026-109383 (GCVE-0-2026-109383)

CVE-2026-109829 (GCVE-0-2026-109829)

CVE-2026-109841 (GCVE-0-2026-109841)

CVE-2026-109869 (GCVE-0-2026-109869)

CVE-2026-109924 (GCVE-0-2026-109924)

CVE-2026-109932 (GCVE-0-2026-109932)

CVE-2026-113872 (GCVE-0-2026-113872)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour