| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetCVE-2026-90711 · GHSA-JQCG-44MW-7W3H |
proxy-addrAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityCVE-2026-84394 · GHSA-58MR-GQGX-XQ4G |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676 · GHSA-4C8G-83QW-93J6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesCVE-2026-75931 · GHSA-5JGF-P345-68V8 |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationCVE-2026-75975 · GHSA-F65P-4M7J-42XC |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to host confusion via literal backslash authority delimiterCVE-2026-16221 · GHSA-V2HH-GCRM-F6HX |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950 · GHSA-R6Q2-HW4H-H46W |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationCVE-2026-23745 · GHSA-8QQ5-RM4J-MR97 |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 |
qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingCVE-2026-75899 · GHSA-FPH4-WMHF-6FWF |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
