RHSA-2026:69255

Immutable.js provides many Persistent Immutable data structures.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

js-yaml is a JavaScript YAML parser and dumper.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Pillow is a Python imaging library.

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

Pillow is a Python imaging library.

tmp is a temporary file and directory creator for node.js.

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

WebOb provides objects for HTTP requests and responses.

js-yaml is a JavaScript YAML parser and dumper.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

pyasn1 is a generic ASN.1 library for Python.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

brace-expansion through 5.0.6 is vulnerable to denial of service.

pyasn1 is a generic ASN.1 library for Python.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

A flaw was found in Quay.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

Podman is a tool for managing OCI containers and pods.

A flaw was found in Red Hat Quay's repository-level mirror configuration feature.

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.