Red Hat Developer Hub (RHDH) is an enterprise-grade developer portal based on Backstage.io, supported on Kubernetes platforms. Multiple vulnerabilities (CVE-2025-32996, CVE-2025-32997, CVE-2025-47273, CVE-2025-48387) affect RHDH versions >=1.6.0 and <1.6.2. One notable issue (CVE-2025-32996) is a control flow flaw in the http-proxy-middleware component, allowing the writeBody function to be called twice due to improper control flow handling. These vulnerabilities have been addressed in RHDH 1.6.2 and later releases. Red Hat has not provided a CVSS score but classifies the severity as high. No known exploits in the wild have been reported. The vendor advisory recommends upgrading to version 1.6.2 or later.

The vulnerabilities could lead to altered execution logic and potential security issues related to control flow and path traversal in the affected RHDH versions. The specific impact includes the possibility of the writeBody function being called twice, which may affect application stability or behavior. Red Hat rates the severity as high but no active exploitation is known. The impact is limited to affected versions prior to 1.6.2.

Red Hat has released Red Hat Developer Hub version 1.6.2 which addresses these vulnerabilities. Users should upgrade to version 1.6.2 or later to remediate the issues. No other mitigations are recommended or available that meet Red Hat's criteria for ease of use and applicability. There are no known workarounds or temporary fixes. Patch status is confirmed by the vendor advisory.