TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw
node-tar: Decompression/parse DoS via unlimited input
Priority HIGH 79
node-tar is a tar archive manipulation library for Node.js.
RHSA-2026:63371
General availability of the satellite/iop-remediations-rhel9 container image
Released 2026-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
Fixes 6 records
TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w
node-tar: Negative tar entry size causes infinite loop in archive replace
Priority HIGH 77
node-tar is a tar archive manipulation library for Node.js.
TI-2026-48541 CVE-2026-69192 · GHSA-mwp4-54f8-5fhr
Improper input validation in beaugunderson ip-address
Priority HIGH 75
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-11539 CVE-2026-13676 · GHSA-4c8g-83qw-93j6
fast-uri vulnerable to host confusion via failed IDN canonicalization
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.