| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
High
|
Fix reported |
|
| React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to cross-user information disclosure via shared cache whitespace bypassCVE-2026-9678 · GHSA-PR7R-676H-XCF6 |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to HTTP header injection via Set-Cookie percent-decodingCVE-2026-9679 · GHSA-P88M-4JFJ-68FV |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentCVE-2026-9697 · GHSA-VMH5-MC38-953G |
undiciCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
High
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingCVE-2026-11525 · GHSA-G8M3-5G58-FQ7M |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to HTTP response queue poisoning via keep-alive socket reuseCVE-2026-6733 · GHSA-35P6-XMWP-9G52 |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| protobuf.js: Denial of service from crafted field names in generated codeCVE-2026-44294 · GHSA-2PR8-PHX7-X9H3 |
protobufjsCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| Mafintosh's protocol-buffers-schema is vulnerable to prototype pollutionCVE-2026-5758 · GHSA-J452-XHG8-QG39 |
protocol-buffers-schemaCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 |
@remix-run/routerreact-router |
npmRed Hat |
Medium
|
Fix reported |
|
| qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 |
qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetCVE-2026-69153 · GHSA-FXQJ-RQCC-2CMP |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59875 · GHSA-GVWX-54WH-QM9J |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationCVE-2026-53666 · GHSA-337J-9HXR-RHXG |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentCVE-2026-49978 · GHSA-RP9W-3FW7-7CWQ |
dompurifyCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modesCVE-2026-65900 · GHSA-GVMJ-G25R-R7WR |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesCVE-2026-53550 · GHSA-H67P-54HQ-RP68 |
js-yamlCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
