RHSA-2026:13571

Netty is an asynchronous, event-driven network application framework.

In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio.

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

Next.js is a React framework that can provide building blocks to create web applications.

Netty is an asynchronous, event-driven network application framework.

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

The net/url package does not set a limit on the number of query parameters in a query.

Next.js is a React framework for building full-stack web applications.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.