Red Hat Quay versions >=3.9.0 <3.9.20 are affected by several security vulnerabilities, notably CVE-2026-29063, a Prototype Pollution vulnerability in the Immutable.js library. This flaw allows attackers with low privileges to inject properties into JavaScript object prototypes via specific API calls, potentially enabling arbitrary code execution or denial of service. Exploitation requires the attacker to supply crafted data to affected functions, which typically requires some level of access to the application. Red Hat released Quay 3.9.20 containing bug fixes to address these issues. The advisory references multiple CVEs and CWE categories related to improper modification of object attributes and integrity violations. No known exploits in the wild have been reported.

The vulnerabilities impact the integrity and availability of Red Hat Quay by allowing attackers with low privileges to manipulate application data and potentially execute arbitrary code or cause denial of service. Confidentiality, integrity, and availability impacts are rated high based on the underlying Prototype Pollution flaw and related issues. However, exploitation requires some degree of access to supply malicious input to the affected APIs.

A fixed version, Red Hat Quay 3.9.20, is available and should be applied to remediate these vulnerabilities. Before updating, ensure all previously released errata relevant to your system are applied. No additional mitigations are specified by Red Hat. There are no known exploits in the wild, so applying the official update is the recommended action.