RHSA-2026:68754

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

linkify-it is a links recognition library with full Unicode support.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

node-tar is a tar archive manipulation library for Node.js.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

linkify-it is a links recognition library with full Unicode support.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimi…

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: appli…

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

Netty is a network application framework for development of protocol servers and clients.

js-yaml is a JavaScript YAML parser and dumper.

Netty is an asynchronous, event-driven network application framework.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

Netty is a network application framework for development of protocol servers and clients.

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

fast-uri is a URI parser for Node.js.

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.

fast-uri serializes the port component of a URI without validating it.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

Netty is an asynchronous, event-driven network application framework.

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts.

Netty is a network application framework for development of protocol servers and clients.