RHSA-2026:95360

Handlebars provides the power necessary to let users build semantic templates.

Handlebars provides the power necessary to let users build semantic templates.

Immutable.js provides many Persistent Immutable data structures.

### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making pr…

gRPC-Go is the Go language implementation of gRPC.

Uncontrolled Recursion vulnerability in Apache Thrift go bindings.

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings.

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips.

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.