RHSA-2026:63307

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

js-yaml is a JavaScript YAML parser and dumper.

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

tmp is a temporary file and directory creator for node.js.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

A flaw was found in Quay.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Podman is a tool for managing OCI containers and pods.

A flaw was found in Red Hat Quay's repository-level mirror configuration feature.