| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsCVE-2026-109829 · GHSA-4W7W-5XRC-9H26 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentCVE-2026-109383 · GHSA-2M5V-PCH6-74HX |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationCVE-2026-87018 · GHSA-QRXM-FQHP-JWVM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsCVE-2026-109869 · GHSA-XJJ6-F33Q-929C |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to downstream response splitting via retry interceptorCVE-2026-18540 · GHSA-R53P-7PC4-XJ5R |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to Denial of Service via unrequested WebSocket subprotocolCVE-2026-19534 · GHSA-RFGV-XXQX-MFG5 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84890 · GHSA-3XPG-4RPP-HHHM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolCVE-2026-84961 · GHSA-W293-VG96-WGC3 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsCVE-2026-85152 · GHSA-VP8M-P9JH-Q5PM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to caching and replay of unsafe HTTP method responsesCVE-2026-85008 · GHSA-8436-99HF-9MMV |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
