RHSA-2026:13826

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).

flatted is a circular JSON parser.

basic-ftp is an FTP client for Node.js.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

flatted is a circular JSON parser.

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing.

Axios is a promise based HTTP client for the browser and Node.js.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Axios is a promise based HTTP client for the browser and Node.js.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

Immutable.js provides many Persistent Immutable data structures.

Backstage is an open framework for building developer portals.

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`.

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.

Underscore.js is a utility-belt library for JavaScript.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage).