TI-2026-42693 CVE-2026-59879 · GHSA-v56q-mh7h-f735
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Priority HIGH 77
Immutable.js provides many Persistent Immutable data structures.
RHSA-2026:77656
Red Hat Quay 3.9.27
Released 2026-10-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
Fixes 15 records
TI-2026-36731 CVE-2026-49825 · GHSA-4jhm-jv67-739f
lxml: javascript: URL bypass in Cleaner via xlink:href
Priority HIGH 69
lxml is a library for processing XML and HTML in the Python language.
TI-2026-56824 CVE-2026-82417 · GHSA-4mjr-xmp4-gh2g
qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property
Priority HIGH 67
### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member.
TI-2026-14229 CVE-2026-17106 · GHSA-hfg8-hc9c-6c3h
Tar extraction in moby/go-archive can write outside the destination directory via link following
Priority HIGH 66
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory.
TI-2026-39576 CVE-2026-54770 · GHSA-6hx8-3wjj-gr8g
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Priority MEDIUM 60
WebOb provides objects for HTTP requests and responses.
TI-2026-55291 CVE-2026-79921 · GHSA-6c5v-hqjr-5xxp
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
Priority MEDIUM 45
amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-54002 CVE-2026-77412 · GHSA-4v58-74mf-rjx3
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
Priority MEDIUM 45
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-53999 CVE-2026-77409
RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking
Priority MEDIUM 42
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-59907 CVE-2026-87776 · GHSA-vc2v-76pw-4v95
compression vulnerable to Denial of Service via memory leak on premature response close
Priority LOW 39
compression is a Node.js and Express compression middleware.
TI-2026-58005 CVE-2026-84394 · GHSA-58mr-gqgx-xq4g
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Priority LOW 39
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.
TI-2026-54000 CVE-2026-77410 · GHSA-r9c8-gcjp-xfwh
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Priority LOW 39
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-53993 CVE-2026-77403 · GHSA-xwwf-m8fg-p9q2
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
Priority LOW 39
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-57933 CVE-2026-84292 · GHSA-qw65-cvwx-89v3
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.
TI-2026-53994 CVE-2026-77404 · GHSA-465g-fh3v-9jw4
RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
Priority LOW 38
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.
TI-2026-53996 CVE-2026-77406 · GHSA-rm6m-hrcw-jw33
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
Priority LOW 36
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client.