RHSA-2026:21772

Axios is a promise based HTTP client for the browser and Node.js.

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).

Let's Encrypt client and ACME library written in Go (Lego).

Axios is a promise based HTTP client for the browser and Node.js.

flatted is a circular JSON parser.

express-rate-limit is a basic rate-limiting middleware for Express.

Axios is a promise based HTTP client for the browser and Node.js.

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function.

node-tar is a full-featured Tar for Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Axios is a promise based HTTP client for the browser and Node.js.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Thymeleaf is a server-side Java template engine for web and standalone environments.

Thymeleaf is a server-side Java template engine for web and standalone environments.

Traefik is an HTTP reverse proxy and load balancer.

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

Traefik is an HTTP reverse proxy and load balancer.

Traefik is an HTTP reverse proxy and load balancer.

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.

Traefik is an HTTP reverse proxy and load balancer.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compr…

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.

The Go MCP SDK used Go's standard encoding/json.

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.

Values produced by ${random.value} are not suitable for use as secrets.

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc.

The Go MCP SDK used Go's standard encoding/json.

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.