| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 |
zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| MCP TypeScript SDK: Experimental tasks were not tied to the session that created themCVE-2026-111767 · GHSA-22JM-H49P-29QW |
@modelcontextprotocol/sdkRed Hat Ansible Automation Platform 2/ansible-automation-platform-27/mcp-server-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsCVE-2026-111757 · GHSA-5R4P-P66F-JHC7 |
honoRed Hat Ansible Automation Platform 2/ansible-automation-platform-27/mcp-server-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverCVE-2026-104850 · GHSA-6QXP-VCCF-F47H |
@modelcontextprotocol/client@modelcontextprotocol/sdk |
npmRed Hat |
High
|
Fix reported |
|
| proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetCVE-2026-90711 · GHSA-JQCG-44MW-7W3H |
proxy-addrAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| hono/jsx renders plain strings unescaped in boundary components, leading to XSSCVE-2026-93981 · GHSA-HXH3-VQPV-XPQV |
honoMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassCVE-2026-69192 · GHSA-MWP4-54F8-5FHR |
ip-addressExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksCVE-2026-54272 · GHSA-22JQ-VG5J-6VGG |
ip-addressMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
Medium
|
Fix reported |
|
| Hono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityCVE-2026-59895 · GHSA-W62V-XXXG-MG59 |
honoMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 |
qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| qs array-limit bypass via bracket-key comma parsingCVE-2026-82562 · GHSA-X5FP-WJ9C-MXMX |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-69198 · GHSA-4XRF-JV44-H6HH |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationCVE-2026-59897 · GHSA-XGM2-5F3F-MVVC |
honoMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
