TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
Priority HIGH 77
linkify-it is a links recognition library with full Unicode support.
RHSA-2026:48126
Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
Released 2026-07-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
Fixes 12 records
TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-34281 CVE-2026-46625 · GHSA-qjx8-664m-686j
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Priority HIGH 72
JavaScript Cookie is a JavaScript API for handling cookies, client-side.
TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Priority MEDIUM 61
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-35510 CVE-2026-48069 · GHSA-99f4-grh7-6pcq
@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
Priority MEDIUM 41
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.
TI-2026-35509 CVE-2026-48068 · GHSA-5375-pq7m-f5r2
@grpc/grps-js: A malformed request can cause a server crash
Priority MEDIUM 41
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.
TI-2026-11539 CVE-2026-13676 · GHSA-4c8g-83qw-93j6
fast-uri vulnerable to host confusion via failed IDN canonicalization
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
TI-2026-42691 CVE-2026-59877 · GHSA-j3f2-48v5-ccww
protobufjs: Denial of Service via infinite loop in .proto option parsing
Priority LOW 39
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-04434 CVE-2026-5079 · GHSA-72gw-mp4g-v24j
multer vulnerable to Denial of Service via deeply nested field names
Priority LOW 39
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data.
TI-2026-04396 CVE-2026-5038 · GHSA-3p4h-7m6x-2hcm
multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Priority LOW 39
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage.
TI-2026-33477 CVE-2026-45740 · GHSA-jggg-4jg4-v7c6
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
Priority LOW 38
protobufjs compiles protobuf definitions into JavaScript (JS) functions.