RHSA-2026:34342

Handlebars provides the power necessary to let users build semantic templates.

flatted is a circular JSON parser.

form-data is a library for creating readable multipart/form-data streams.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

ws is an open source WebSocket client and server for Node.js.

Handlebars provides the power necessary to let users build semantic templates.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

flatted is a circular JSON parser.

Handlebars provides the power necessary to let users build semantic templates.

Handlebars provides the power necessary to let users build semantic templates.

Handlebars provides the power necessary to let users build semantic templates.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

Immutable.js provides many Persistent Immutable data structures.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion.

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.

launch-editor allows users to open files with line numbers in editor from Node.js.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Picomatch is a glob matcher written JavaScript.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.).

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing.

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component.