TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:41929
Red Hat Developer Hub 1.9.7 release.
Released 2026-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Fixes 8 records
TI-2026-32777 CVE-2026-44902 · GHSA-q7rr-3cgh-j5r3
opentelemetry-js: Prometheus exporter process crash via malformed HTTP request
Priority HIGH 72
opentelemetry-js is the OpenTelemetry JavaScript Client.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
TI-2026-11539 CVE-2026-13676 · GHSA-4c8g-83qw-93j6
fast-uri vulnerable to host confusion via failed IDN canonicalization
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
TI-2026-10459 CVE-2026-12151 · GHSA-vxpw-j846-p89q
undici WebSocket client vulnerable to denial of service via fragment count bypass
Priority MEDIUM 40
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.
TI-2026-05900 CVE-2026-6734 · GHSA-hm92-r4w5-c3mj
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
Priority MEDIUM 40
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.
TI-2026-33477 CVE-2026-45740 · GHSA-jggg-4jg4-v7c6
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
Priority LOW 38
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-08499 CVE-2026-9697 · GHSA-vmh5-mc38-953g
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
Priority LOW 35
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).