RHSA-2026:92650

Immutable.js provides many Persistent Immutable data structures.

js-yaml is a JavaScript YAML parser and dumper.

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.

urllib3 is an HTTP client library for Python.

urllib3 is a user-friendly HTTP client library for Python.

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.

js-yaml is a JavaScript YAML parser and dumper.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.

urllib3 is a user-friendly HTTP client library for Python.

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

fast-uri is a URI parser for Node.js.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.

fast-uri serializes the port component of a URI without validating it.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

fast-uri is a URI parser for Node.js.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.