| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to downstream response splitting via retry interceptorCVE-2026-18540 · GHSA-R53P-7PC4-XJ5R |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84890 · GHSA-3XPG-4RPP-HHHM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolCVE-2026-84961 · GHSA-W293-VG96-WGC3 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsCVE-2026-85152 · GHSA-VP8M-P9JH-Q5PM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to caching and replay of unsafe HTTP method responsesCVE-2026-85008 · GHSA-8436-99HF-9MMV |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to response truncation via oversized chunked responses in the dump interceptorCVE-2026-84947 · GHSA-2GQQ-GQF2-X968 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to Denial of Service via WebSocketStream unclean closeCVE-2026-85014 · GHSA-RX4F-C7P8-82VQ |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionCVE-2026-85024 · GHSA-3WWX-PV8P-Q78V |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsCVE-2026-87859 · GHSA-9F6G-J8CH-79G4 |
morganCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to HTTP header injection via Set-Cookie percent-decodingCVE-2026-9679 · GHSA-P88M-4JFJ-68FV |
undiciCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
