RHSA-2026:59559

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

form-data is a library for creating readable multipart/form-data streams.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

js-yaml is a JavaScript YAML parser and dumper.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes.

A flaw was found in the cluster-curator-controller component.

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE).

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

A flaw was found in the managedcluster-import-controller.

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE).

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE).

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

Billy is an interface filesystem abstraction for Go.

The HTTP client drops sensitive headers after following a cross-domain redirect.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE).

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.