RHSA-2026:70593

gRPC-Go is the Go language implementation of gRPC.

js-yaml is a JavaScript YAML parser and dumper.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

fast-uri is a URI parser for Node.js.

gopacket provides packet processing capabilities for Go.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

fast-uri serializes the port component of a URI without validating it.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.