TI-2026-42693 CVE-2026-59879 · GHSA-v56q-mh7h-f735
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Priority HIGH 77
Immutable.js provides many Persistent Immutable data structures.
RHSA-2026:68765
Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
Released 2026-09-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
Fixes 13 records
TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
TI-2026-51730 CVE-2026-73646 · GHSA-r28c-9q8g-f849
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Priority HIGH 72
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-51295 CVE-2026-73088 · GHSA-73wf-gq98-2v4g
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Priority HIGH 72
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
TI-2026-47617 CVE-2026-67321 · GHSA-hcpx-6fm6-wx23
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Priority HIGH 70
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.
TI-2026-47609 CVE-2026-67313 · GHSA-42h9-826w-cgv3
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
Priority HIGH 67
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.
TI-2026-47610 CVE-2026-67314 · GHSA-xj6q-8x83-jv6g
axios before 1.18.0 Prototype Pollution via auth subfields
Priority MEDIUM 61
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).
TI-2026-51296 CVE-2026-73089 · GHSA-c83g-rgw3-j3cx
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
Priority MEDIUM 40
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
TI-2026-53157 CVE-2026-75931 · GHSA-5jgf-p345-68v8
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
Priority LOW 39
fast-uri is a URI parser for Node.js.
TI-2026-53285 CVE-2026-76172 · GHSA-jqff-g426-hqxp
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-53188 CVE-2026-75975 · GHSA-f65p-4m7j-42xc
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
Priority LOW 38
fast-uri is a URI parser for Node.js.
TI-2026-47616 CVE-2026-67320 · GHSA-gcfj-64vw-6mp9
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
Priority LOW 37
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.
TI-2026-33551 CVE-2026-45819 · GHSA-w5vr-8v7q-w6rv
Improper handling of exceptional conditions in web-platform-dx baseline-browser-mapping
Priority LOW 36
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.