VDB

RHSA-2026%3A3109

RHSA-2026%3A3109 PUBLISHED CVSS 7.5 HIGH

Record from redhat · Published February 23, 2026

A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64 as a component of Red Hat OpenShift Service Mesh 3.2*
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64 as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64 as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64 as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64 as a component of Red Hat OpenShift Service Mesh 3.2registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64, *
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64 as a component of Red Hat OpenShift Service Mesh 3.2*, registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64 as a component of Red Hat OpenShift Service Mesh 3.2registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64, *
Red Hatregistry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x as a component of Red Hat OpenShift Service Mesh 3.2registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x, *

Timeline

  • Feb 23, 2026 CVE Published
  • May 5, 2026 Distribution Patch (2 in total, the first dated here)
  • May 5, 2026 Security Advisory (2 in total, the first dated here)
  • May 13, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln RHSA-2026%3A3109
vulnetix vdb fixes RHSA-2026%3A3109

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%253A3109/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›