TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:38236
Red Hat Hardened Images RPMs Security Update
Released 2026-07-11 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images nodejs24-1:24.18.0-0.3.hum1@aarch64, nodejs24-1:24.18.0-0.3.hum1@src, nodejs24-1:24.18.0-0.3.hum1@x86_64 +16
Fixes 10 records
TI-2026-10459 CVE-2026-12151 · GHSA-vxpw-j846-p89q
undici WebSocket client vulnerable to denial of service via fragment count bypass
Priority MEDIUM 40
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.
TI-2026-05900 CVE-2026-6734 · GHSA-hm92-r4w5-c3mj
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Priority MEDIUM 40
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.
TI-2026-08499 CVE-2026-9697 · GHSA-vmh5-mc38-953g
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Priority LOW 35
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).
TI-2026-38621 CVE-2026-53550 · GHSA-h67p-54hq-rp68
js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases
Priority LOW 30
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-04433 CVE-2026-5078 · GHSA-4vj7-5mj6-jm8m
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
Priority LOW 30
Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters.
TI-2026-08489 CVE-2026-9678 · GHSA-pr7r-676h-xcf6
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
Priority LOW 27
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorizatio…
TI-2026-08490 CVE-2026-9679 · GHSA-p88m-4jfj-68fv
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
Priority LOW 26
Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents.
TI-2026-09954 CVE-2026-11525 · GHSA-g8m3-5g58-fq7m
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
Priority LOW 17
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.
TI-2026-05899 CVE-2026-6733 · GHSA-35p6-xmwp-9g52
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
Priority LOW 17
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets.