TI-2026-42685 CVE-2026-59870 · GHSA-724g-mxrg-4qvm
js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:9455
Red Hat Hardened Images RPMs bug fix and enhancement update
Released 2026-04-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Hardened Images nodejs20-20.20.2-1.hum1@aarch64, nodejs20-20.20.2-1.hum1@src, nodejs20-20.20.2-1.hum1@x86_64 +14
Fixes 14 records
TI-2026-42683 CVE-2026-59868 · GHSA-g796-fgmg-93mv
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-07665 CVE-2026-8723 · GHSA-q8mj-m7cp-5q26
qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly
Priority HIGH 67
### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`.
TI-2026-36192 CVE-2026-48933 · GHSA-pvpp-9x2p-fxg3
Integer overflow in NodeJS node
Priority MEDIUM 45
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
TI-2026-36189 CVE-2026-48930 · GHSA-g779-8rvr-37xx
Improper access control in NodeJS node
Priority MEDIUM 42
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.
TI-2026-35965 CVE-2026-48619 · GHSA-v3cq-r2f8-qmmc
Uncontrolled resource consumption in NodeJS node
Priority MEDIUM 40
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.
TI-2026-35964 CVE-2026-48618 · GHSA-g57m-hr98-5m89
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…
Priority LOW 35
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.
TI-2026-02542 CVE-2026-2950 · GHSA-f23m-r3pf-42rh
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Priority LOW 35
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
TI-2026-35961 CVE-2026-48615 · GHSA-qqjm-7pv6-7q82
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in…
Priority LOW 33
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
TI-2026-32977 CVE-2026-45149 · GHSA-jxxr-4gwj-5jf2
brace-expansion: Large numeric range defeats documented `max` DoS protection
Priority LOW 33
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-36187 CVE-2026-48928 · GHSA-3h92-9jcv-8677
Improper access control in NodeJS node
Priority LOW 24
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
TI-2026-36193 CVE-2026-48934 · GHSA-px9q-xv67-75fr
Improper certificate validation in NodeJS node
Priority LOW 20
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
TI-2026-36195 CVE-2026-48936 · GHSA-hwhp-f859-r728
Improper access control in NodeJS node
Priority LOW 15
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.
TI-2026-36194 CVE-2026-48935 · GHSA-9qm6-cjgc-f64v
Incorrect default permissions in NodeJS node
Priority LOW 15
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.