RHSA-2026:20041

Axios is a promise based HTTP client for the browser and Node.js.

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow.

gRPC-Go is the Go language implementation of gRPC.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

Immutable.js provides many Persistent Immutable data structures.

spdystream is a Go library for multiplexing streams over SPDY connections.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

The net/url package does not set a limit on the number of query parameters in a query.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

React Router is a router for React.

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading…