SB2026101520 - Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging

Description

This security bulletin contains information about 19 vulnerabilities.

1) Inefficient regular expression complexity (CVE-ID: CVE-2026-44496)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in lib/helpers/cookies.js read(name) when processing an attacker-controlled XSRF cookie name while reading document.cookie. A remote attacker can supply a crafted cookie name containing regex metacharacters to cause a denial of service.

The issue affects standard browser environments and can freeze the affected browser tab while axios prepares a request. Applications are affected only when attacker-controlled data reaches the XSRF cookie name configuration or an unsafe direct call to the internal cookie helper.

2) Prototype pollution (CVE-ID: CVE-2026-67320)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the Node.js HTTP adapter request path when processing interceptor-returned regular object configs with a polluted Object.prototype.proxy. A remote user can trigger prototype pollution elsewhere in the process and cause affected HTTP requests to be routed through an attacker-controlled proxy to disclose sensitive information.

Exploitation requires Node.js HTTP adapter usage and a request interceptor that returns a plain object copy of the request configuration. The confirmed disclosure impact is limited to plaintext HTTP requests and can expose authorization headers, request metadata, and request body content.

3) Information disclosure (CVE-ID: CVE-2026-44486)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper handling of sensitive headers in the Node.js HTTP adapter in lib/adapters/http.js when following redirects after proxy settings are re-evaluated from an authenticated proxy to a direct connection. A remote attacker can cause the application to follow a crafted redirect so that proxy credentials are sent to the redirect target to disclose sensitive information.

Only the Node.js HTTP adapter is affected, and exploitation requires automatic redirects to be enabled with an authenticated proxy configuration.

4) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-44487)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into sent data in the Node.js HTTP adapter when following an HTTP-to-HTTPS redirect from a proxied request to a direct request. A remote attacker can trigger a crafted redirect flow to disclose sensitive information.

Only Node.js requests using the HTTP adapter are affected, and exploitation requires redirects to be followed and proxy credentials to be configured for the initial HTTP request but not for the redirected HTTPS request.

5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-44488)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the fetch adapter when processing requests and responses with configured finite size limits. A remote attacker can supply an oversized response, a large data: URL, or an oversized request body to cause a denial of service.

The issue affects server-side usage where applications rely on maxContentLength or maxBodyLength being enforced by the fetch adapter.

6) Prototype pollution (CVE-ID: CVE-2026-44489)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in "setProxy()" function in lib/adapters/http.js. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in data manipulation.

7) Prototype pollution (CVE-ID: CVE-2026-44490)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in the merge() function in lib/utils.js. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in data manipulation or denial of service (DoS) condition.

8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-44492)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to the "shouldBypassProxy" does not normalise IPv4-mapped IPv6 addresses. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

9) Prototype pollution (CVE-ID: CVE-2026-44494)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in config.proxy. A remote attacker can pass specially crafted input to the application and perform a man-in-the-middle (MitM) attack, which can result in information disclosure or data manipulation.

10) Uncontrolled Recursion (CVE-ID: CVE-2026-67321)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in lib/helpers/toFormData.js when serializing an object with a top-level key ending in {} and a deeply nested object value. A remote attacker can supply crafted object keys and nested values to trigger a stack overflow and cause a denial of service.

The issue affects form and parameter serialization paths that delegate to toFormData, and the thrown error is a raw RangeError rather than the intended AxiosError depth-limit signal.

11) Uncontrolled Recursion (CVE-ID: CVE-2026-67313)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in formDataToJSON when processing attacker-controlled FormData field names during FormData-to-JSON conversion. A remote attacker can supply a crafted FormData field name with deeply nested bracket segments to cause a denial of service.

The vulnerable request-transform path is reached when FormData is sent with an application/json content type, and direct use of formToJSON() throws synchronously.

12) Prototype pollution (CVE-ID: CVE-2018-16487)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the merge, mergeWith, and defaultsDeep functions. A remote attacker can send a specially crafted request and add or modify properties of Object.prototype.

Successful exploitation of this vulnerability may result in complete compromise of the affected application.

13) Prototype pollution (CVE-ID: CVE-2026-67314)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to tamper with outbound requests.

The vulnerability exists due to improper control of object prototype attributes in Basic auth handling in lib/adapters/http.js and lib/helpers/resolveConfig.js when processing requests with an own auth object that omits username or password in a host process already affected by prototype pollution. A remote user can pollute Object.prototype.username and Object.prototype.password to tamper with outbound requests.

Exploitation requires a separate prototype-pollution primitive in the host process, and affects requests where config.auth is an own object but username and/or password are absent own properties.

14) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-67315)

CWE-ID: CWE-183 - Permissive List of Allowed Inputs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform server-side request forgery against local services through a configured proxy.

The vulnerability exists due to permissive list of allowed inputs in lib/helpers/shouldBypassProxy.js when evaluating NO_PROXY rules for requests to 0.0.0.0 in the Node.js HTTP adapter. A remote attacker can supply a crafted request URL or redirect target to perform server-side request forgery against local services through a configured proxy.

Exploitation requires axios to run in Node.js with environment proxy variables enabled, attacker-controlled input to influence the request URL or redirect target, and a proxy that can reach or relay 0.0.0.0 to local destinations.

15) Prototype pollution (CVE-ID: CVE-2026-67316)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to alter request semantics.

The vulnerability exists due to improperly controlled modification of object prototype attributes in bodyless method aliases in lib/core/Axios.js when processing requests after Object.prototype has already been polluted. A remote user can pollute Object.prototype.data to alter request semantics.

Exploitation requires chaining with a separate prototype pollution condition in the same process.

16) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67317)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause resource consumption and exhaust upstream quotas or bandwidth.

The vulnerability exists due to allocation of resources without limits or throttling in the fetch adapter when processing attacker-controlled unknown-length WHATWG ReadableStream request bodies. A remote attacker can supply a specially crafted streamed request body to cause resource consumption and exhaust upstream quotas or bandwidth.

Exploitation requires an application to use the fetch adapter, set a finite maxBodyLength value, and pass attacker-controlled stream data without a reliable Content-Length.

17) Resource exhaustion (CVE-ID: CVE-2026-67318)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause uncontrolled resource consumption.

The vulnerability exists due to uncontrolled resource consumption in the Node.js HTTP/2 upload handling in the HTTP adapter when processing attacker-controlled streamed request bodies with httpVersion: 2 and a finite maxBodyLength. A remote user can supply a specially crafted oversized stream to cause uncontrolled resource consumption.

Only the Node.js HTTP adapter is affected. Browser adapters are not affected, and buffered request bodies are checked before the request is sent.

18) Prototype pollution (CVE-ID: CVE-2026-67319)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to tamper with outbound requests and disclose sensitive information.

The vulnerability exists due to improperly controlled modification of object prototype attributes in nested axios request option objects when processing placeholder nested option objects in a JavaScript process with a polluted Object.prototype. A remote user can pollute inherited username, password, encode, or serialize properties to tamper with outbound requests and disclose sensitive information.

Exploitation requires a separate prototype-pollution primitive in the same process, and affected cases include auth or paramsSerializer objects that omit their own relevant properties.

19) Resource exhaustion (CVE-ID: CVE-2026-67312)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in formDataToJSON when parsing attacker-controlled FormData field names with deeply nested bracket segments. A remote attacker can send crafted FormData input to cause a denial of service.

The issue affects direct use of axios.formToJSON() and JSON serialization of FormData when the Content-Type contains application/json.

Remediation

Install update from vendor's website.

References

• https://www.ibm.com/support/pages/node/7290234