TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:17474
OpenShift Container Platform 4.21.16 bug fix and security update
Released 2026-05-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9 +13
Fixes 10 records
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Priority MEDIUM 62
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-28989 CVE-2026-40175 · GHSA-fvcv-3m26-pcqx
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Priority MEDIUM 57
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects
Priority LOW 38
React Router is a router for React.
TI-2026-26368 CVE-2026-34043 · GHSA-qj8w-gfj5-8c6v
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Priority LOW 33
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.