RHSA-2026:48124

node-tar is a tar archive manipulation library for Node.js.

node-tar is a tar archive manipulation library for Node.js.

form-data is a library for creating readable multipart/form-data streams.

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

js-yaml is a JavaScript YAML parser and dumper.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Netty is a network application framework for development of protocol servers and clients.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

brace-expansion through 5.0.6 is vulnerable to denial of service.

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

Netty is a network application framework for development of protocol servers and clients.

React Router is a router for React.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

React Router is a router for React.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.