RHSA-2026:41928

form-data is a library for creating readable multipart/form-data streams.

Axios is a promise based HTTP client for the browser and Node.js.

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

ws is an open source WebSocket client and server for Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

pyasn1 is a generic ASN.1 library for Python.

pyasn1 is a generic ASN.1 library for Python.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

node-tar is a Tar for Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

ws is an open source WebSocket client and server for Node.js.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

urllib3 is an HTTP client library for Python.

gRPC-Go is the Go language implementation of gRPC.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

Immutable.js provides many Persistent Immutable data structures.

urllib3 is a user-friendly HTTP client library for Python.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

The net/url package does not set a limit on the number of query parameters in a query.

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applie…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

brace-expansion through 5.0.6 is vulnerable to denial of service.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

urllib3 is a user-friendly HTTP client library for Python.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

React Router is a router for React.

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

decode-uri-component through 0.4.1 is vulnerable to denial of service.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

runc is a CLI tool for spawning and running containers according to the OCI specification.

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.