RHSA-2026:6192

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic.

node-tar is a Tar for Node.js.

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Axios is a promise based HTTP client for the browser and Node.js.

The net/url package does not set a limit on the number of query parameters in a query.

Traefik is an HTTP reverse proxy and load balancer.

Glob matches files using patterns the shell uses.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3.

Traefik is an HTTP reverse proxy and load balancer.

Fastify is a fast and low overhead web framework, for Node.js.

node-tar is a full-featured Tar for Node.js.

Traefik is an HTTP reverse proxy and load balancer.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.