RHSA-2026:56431

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).

linkify-it is a links recognition library with full Unicode support.

form-data is a library for creating readable multipart/form-data streams.

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs.

js-yaml is a JavaScript YAML parser and dumper.

ws is an open source WebSocket client and server for Node.js.

ws is an open source WebSocket client and server for Node.js.

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2.

gRPC-Go is the Go language implementation of gRPC.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

spdystream is a Go library for multiplexing streams over SPDY connections.

The net/url package does not set a limit on the number of query parameters in a query.

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

brace-expansion through 5.0.6 is vulnerable to denial of service.

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.

React Router is a router for React.

Picomatch is a glob matcher written JavaScript.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing.

React Router is a router for React.

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://).

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

Undici is an HTTP/1.1 client for Node.js.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

js-yaml is a JavaScript YAML parser and dumper.

Picomatch is a glob matcher written JavaScript.

js-yaml is a JavaScript YAML parser and dumper.

React Router is a router for React.

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents.

Requests is a HTTP library.

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely…

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265.

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets.