RHSA-2026:45381HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
July 24, 2026
Last Modified
October 22, 2026

🔗 CVE IDs covered (2)

CVE-2026-14257 →CVE-2026-48617 →

📋 Description

CVE-2026-14257 — brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function CVE-2026-48617 — nodejs: Node.js: Permission Model bypass via process.report.writeReport() path misvalidation

🎯 Affected products20

  • Red Hat Hardened Images
  • nodejs22-1:22.23.1-2.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs22-1:22.23.1-2.3.hum1@src as a component of Red Hat Hardened Images
  • nodejs22-1:22.23.1-2.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs22-bin-1:22.23.1-2.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs22-bin-1:22.23.1-2.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs22-devel-1:22.23.1-2.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs22-devel-1:22.23.1-2.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs22-docs-1:22.23.1-2.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs22-docs-1:22.23.1-2.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs22-full-i18n-1:22.23.1-2.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs22-full-i18n-1:22.23.1-2.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs22-libs-1:22.23.1-2.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs22-libs-1:22.23.1-2.3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs22-npm-1:10.9.8-1.22.23.1.2.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs22-npm-1:10.9.8-1.22.23.1.2.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs22-npm-bin-1:22.23.1-2.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs22-npm-bin-1:22.23.1-2.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • v8-12.4-devel-3:12.4.254.21-1.22.23.1.2.3.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not pass untrusted or user-controlled input to brace-expansion's expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion. Where possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output. As an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage. Workaround: No workaround is available for applications that rely on the Permission Model to restrict process.report.writeReport() output paths. Users should upgrade to a fixed Node.js release (22.23.0, 24.17.0, or 26.3.1 and later) as they become available downstream.

🔗 References (6)