TI-2026-51727 CVE-2026-73643 · GHSA-pm4m-ph32-ghv5
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:60478
OpenShift Container Platform 4.21.31 security and extras update
Released 2026-09-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-cluster-capacity-rhel9
Fixes 6 records
TI-2026-51295 CVE-2026-73088 · GHSA-73wf-gq98-2v4g
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Priority HIGH 72
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-51296 CVE-2026-73089 · GHSA-c83g-rgw3-j3cx
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
Priority MEDIUM 40
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
TI-2026-26186 CVE-2026-33814
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.