TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:26225
Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
Released 2026-06-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
Fixes 12 records
TI-2026-30197 CVE-2026-41680 · GHSA-6v9c-7cg6-27q7
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Priority HIGH 77
Marked is a markdown parser and compiler.
TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Priority MEDIUM 62
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
Priority MEDIUM 43
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.