| fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tagsCVE-2026-126066 · GHSA-474X-HRWR-FGX4 |
fast-xml-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 |
deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
No fix reported |
|
| undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsCVE-2026-109829 · GHSA-4W7W-5XRC-9H26 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentCVE-2026-109383 · GHSA-2M5V-PCH6-74HX |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationCVE-2026-87018 · GHSA-QRXM-FQHP-JWVM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsCVE-2026-109869 · GHSA-XJJ6-F33Q-929C |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93749 · GHSA-68FV-2MGG-JV7Q |
source-map-jsNode HealthCheck Operator/redhat-user-workloads/nhc-bundle-0-9 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
