TI-2026-42706 CVE-2026-59892 · GHSA-45rx-2jwx-cxfr
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
Priority HIGH 72
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client.
RHSA-2026:52768
Red Hat Developer Hub 1.9.8 release.
Released 2026-08-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
Fixes 11 records
TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-34281 CVE-2026-46625 · GHSA-qjx8-664m-686j
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Priority HIGH 72
JavaScript Cookie is a JavaScript API for handling cookies, client-side.
TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Priority MEDIUM 61
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-35510 CVE-2026-48069 · GHSA-99f4-grh7-6pcq
@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash
Priority MEDIUM 41
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.
TI-2026-35509 CVE-2026-48068 · GHSA-5375-pq7m-f5r2
@grpc/grps-js: A malformed request can cause a server crash
Priority MEDIUM 41
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
TI-2026-42691 CVE-2026-59877 · GHSA-j3f2-48v5-ccww
protobufjs: Denial of Service via infinite loop in .proto option parsing
Priority LOW 39
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-35993 CVE-2026-48712 · GHSA-wcpc-wj8m-hjx6
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
Priority LOW 39
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-04434 CVE-2026-5079 · GHSA-72gw-mp4g-v24j
multer vulnerable to Denial of Service via deeply nested field names
Priority LOW 39
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data.
TI-2026-04396 CVE-2026-5038 · GHSA-3p4h-7m6x-2hcm
multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Priority LOW 39
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage.