An improper input validation vulnerability (CWE-20) exists in the cipher-base npm package used by Red Hat Developer Hub. The vulnerability arises from missing input type checks in the polyfill implementation of Node.js's createHash function, allowing malicious JSON-stringifyable inputs to cause invalid hash value calculations, hang the process, rewind hash state, and convert tagged hashes into untagged hashes. This can lead to denial of service through resource exhaustion or crashes, and potentially unauthorized modification of memory or execution of arbitrary code. Red Hat has identified this issue affecting Red Hat Developer Hub 1.7 but currently has no fix available that meets their deployment and stability criteria.

The vulnerability can cause denial of service conditions such as crashes or excessive resource consumption (CPU and memory). It also poses risks to integrity by enabling modification of memory or control flow, potentially leading to unauthorized code execution. Confidentiality risks include possible reading of memory or files if resource references are manipulated. The severity is rated high by Red Hat, reflecting significant impact on integrity and availability, though no active exploits are known in the wild.

Currently, no official fix or patch is available for this vulnerability in Red Hat Developer Hub. Red Hat states that existing mitigation options do not meet their criteria for ease of use, applicability, or stability. Users are advised to monitor Red Hat advisories for updates. If possible, consider upgrading to future supported versions once a fix is released. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. Until a fix is available, cautious use of affected components and limiting exposure to untrusted inputs may reduce risk.