Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet8.0: aspnetcore-runtime-8.0-8.0.28-1.2.hum1 aarch64, x8664 aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1 aarch64, x8664 aspnetcore-targeting-pack-8.0-8.0.28-1.2.hum1 aarch64, x8664...

CVE-2026-53486

The CVE affects the Node.js decompress package used for archive extraction. Before versions 10.2.1 and 11.1.3, crafted archives could read or write files outside the target directory due to: hardlink and symlink entries being created without proper target checks; path containment validated by a s...

SUSE CVE-2026-53486

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21936 more potentially affected by CVE-2026-53486 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28825 more potentially affected by CVE-2026-53486 via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2026-53486 Source advisory: SNYK:JS-DECOMPRESS-17874437...

bdy (>=1.18.27-dev, <=1.22.61-stage) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (11.1.1)

@xhmikosr/decompress NPM version 11.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.18.27-dev, =1.22.61-stage Source cves: CVE-2026-53486 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-17874438...

bdy (>=1.18.27-dev, <=1.22.61-stage) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (11.1.1)

@xhmikosr/decompress NPM version 11.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.18.27-dev, =1.22.61-stage Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-53486 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-178744...