| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityCVE-2026-84394 · GHSA-58MR-GQGX-XQ4G |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676 · GHSA-4C8G-83QW-93J6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesCVE-2026-75931 · GHSA-5JGF-P345-68V8 |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationCVE-2026-75975 · GHSA-F65P-4M7J-42XC |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)CVE-2026-73088 · GHSA-73WF-GQ98-2V4G |
browserslistNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via literal backslash authority delimiterCVE-2026-16221 · GHSA-V2HH-GCRM-F6HX |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| js-yaml: Exponential parsing time in flow collections leads to denial of serviceCVE-2026-73643 · GHSA-PM4M-PH32-GHV5 |
js-yamlNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsCVE-2026-13149 · GHSA-3JXR-9VMJ-R5CP |
brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingCVE-2026-75899 · GHSA-FPH4-WMHF-6FWF |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via percent-encoded scheme normalizationCVE-2026-76172 · GHSA-JQFF-G426-HQXP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOMCVE-2026-73089 · GHSA-C83G-RGW3-J3CX |
browserslistNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via backslash authority introducerCVE-2026-18446 · GHSA-7P8R-X3MC-P8W7 |
fast-uriMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
