TI-2026-42693 CVE-2026-59879 · GHSA-v56q-mh7h-f735
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Priority HIGH 77
Immutable.js provides many Persistent Immutable data structures.
RHSA-2026:69289
A Subscription Management tool for finding and reporting Red Hat product usage
Released 2026-09-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Fixes 7 records
TI-2026-56824 CVE-2026-82417 · GHSA-4mjr-xmp4-gh2g
qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
Priority HIGH 67
### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member.
TI-2026-50099 CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p
sqlparse: Quadratic O(n²) DoS in group_comments
Priority MEDIUM 43
sqlparse is a non-validating SQL parser module for Python.
TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Priority MEDIUM 40
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-59907 CVE-2026-87776 · GHSA-vc2v-76pw-4v95
compression vulnerable to Denial of Service via memory leak on premature response close
Priority LOW 39
compression is a Node.js and Express compression middleware.
TI-2026-58005 CVE-2026-84394 · GHSA-58mr-gqgx-xq4g
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Priority LOW 39
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.
TI-2026-57933 CVE-2026-84292 · GHSA-qw65-cvwx-89v3
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.