RHSA-2026:62260

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

node-tar is a tar archive manipulation library for Node.js.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

node-tar is a tar archive manipulation library for Node.js.

form-data is a library for creating readable multipart/form-data streams.

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

Axios is a promise based HTTP client for the browser and Node.js.

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

node-tar is a tar archive manipulation library for Node.js.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

js-yaml is a JavaScript YAML parser and dumper.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

tmp is a temporary file and directory creator for node.js.

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.

The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.

Netty is a network application framework for development of protocol servers and clients.

Netty is an asynchronous, event-driven network application framework.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

containerd is an open-source container runtime.

Traefik is an HTTP reverse proxy and load balancer.

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware.

Traefik is an HTTP reverse proxy and load balancer.

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

Traefik is an HTTP reverse proxy and load balancer.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

Traefik is an HTTP reverse proxy and load balancer.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through mem…

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

brace-expansion through 5.0.6 is vulnerable to denial of service.

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

Netty is a network application framework for development of protocol servers and clients.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.

quic-go is an implementation of the QUIC protocol in Go.

Netty is an asynchronous, event-driven network application framework.

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

containerd is an open-source container runtime.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches…

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memor…

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

Netty is a network application framework for development of protocol servers and clients.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.