RHSA-2026:60477

linkify-it is a links recognition library with full Unicode support.

form-data is a library for creating readable multipart/form-data streams.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

js-yaml is a JavaScript YAML parser and dumper.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Prometheus is an open-source monitoring system and time series database.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's a…

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the…