RHSA-2026:65514

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

tmp is a temporary file and directory creator for node.js.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

A flaw was found in Quay.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.