RHSA-2026:9742

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).

flatted is a circular JSON parser.

basic-ftp is an FTP client for Node.js.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.

flatted is a circular JSON parser.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing.

Axios is a promise based HTTP client for the browser and Node.js.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

Axios is a promise based HTTP client for the browser and Node.js.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

Immutable.js provides many Persistent Immutable data structures.

Backstage is an open framework for building developer portals.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`.

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.

Underscore.js is a utility-belt library for JavaScript.

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage).