RHSA-2024:7164

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.

node-tar is a Tar for Node.js.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should…

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion.

A flaw was found in the github.com/containers/image library.

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes.

Express.js minimalist web framework for node.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie".