TI-2026-22302 CVE-2026-27959 · GHSA-7gcc-r8m5-44qm
Koa has Host Header Injection via `ctx.hostname`
Priority HIGH 72
Koa is middleware for Node.js using ES2017 async functions.
RHSA-2026:7249
OpenShift Container Platform 4.19.28 bug fix and security update
Released 2026-04-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
Fixes 5 records
TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm
Unexpected session resumption in crypto/tls
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4
Memory exhaustion in query parameter parsing in net/url
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
TI-2025-38130 CVE-2025-61728 · GHSA-g9q4-qjx4-2v7q
Excessive CPU consumption when building archive index in archive/zip
Priority LOW 30
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.