RHSA-2026:69248

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

pymdown-extensions is a collection of extensions for the Python Markdown library.

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: appli…

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

fast-uri is a URI parser for Node.js.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.

fast-uri serializes the port component of a URI without validating it.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.