CLEANSTART-2026-SB27821 fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer

Security vulnerability affects the apache-hive package. The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer...

CLEANSTART-2026-CP28423 vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1

Security vulnerability affects the apache-hive package. A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1...

CLEANSTART-2026-DT34494 In pgjdbc before 42

Security vulnerability affects the apache-hive package. In pgjdbc before 42...

CLEANSTART-2026-YH00671 pgjdbc is an open source postgresql JDBC Driver

Security vulnerability affects the apache-hive package. pgjdbc is an open source postgresql JDBC Driver...

CLEANSTART-2026-QN51882 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

CVE-2026-18540 affects multiple packages. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual vulnerability details...

CLEANSTART-2026-VB20350 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

CVE-2026-85024 affects multiple packages. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. See references for individual vulnerability details...

CLEANSTART-2026-QE41365 undici's dump interceptor reads and discards a response body up to a configurable maximum size

CVE-2026-84947 affects multiple packages. undici's dump interceptor reads and discards a response body up to a configurable maximum size. See references for individual vulnerability details...

CLEANSTART-2026-LB53139 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...

CLEANSTART-2026-BT10409 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...

CVE-2026-85008 affects multiple packages. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the...

CLEANSTART-2026-HI60053 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response

CVE-2026-16728 affects multiple packages. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. See references for individual vulnerability details...

CLEANSTART-2026-RE18150 undici's setCookie function does not fully sanitize cookie attributes

CVE-2026-16729 affects multiple packages. undici's setCookie function does not fully sanitize cookie attributes. See references for individual vulnerability details...

CLEANSTART-2026-WL07802 undici's retry handler can leave an already-exposed response body pending forever

CVE-2026-18149 affects multiple packages. undici's retry handler can leave an already-exposed response body pending forever. See references for individual vulnerability details...

CLEANSTART-2026-JM60030 ### Summary When `qs

CVE-2026-82562 affects multiple packages. Summary When qs. See references for individual vulnerability details...

CLEANSTART-2026-WC12371 undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1

CVE-2026-15157 affects multiple packages. undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-EH14078 ### Summary `qs

CVE-2026-82417 affects multiple packages. Summary qs. See references for individual vulnerability details...

CLEANSTART-2026-CB36815 Security fix for GHSA-wmmp-3585-3rmp applied in: langfuse 3.225.9-r0

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VO74481 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

CVE-2026-84933 affects multiple packages. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. See references for individual vulnerability details...

CLEANSTART-2026-YT99310 Security fix for GHSA-8m3c-c648-2xjj applied in: langfuse 3.225.9-r0

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CA85404 undici's experimental WebSocketStream client crashes the whole Node

CVE-2026-85014 affects multiple packages. undici's experimental WebSocketStream client crashes the whole Node. See references for individual vulnerability details...

CLEANSTART-2026-ZC19840 Security fix for GHSA-cc9r-2j5m-2m83 applied in: langfuse 3.225.9-r0

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CK85673 undici's WebSocket client crashes the whole Node

CVE-2026-19534 affects multiple packages. undici's WebSocket client crashes the whole Node. See references for individual vulnerability details...

CLEANSTART-2026-UG48995 undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive

CVE-2026-14643 affects multiple packages. undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. See references for individual vulnerability details...

CLEANSTART-2026-DX95519 Security fix for GHSA-2x7j-588g-ccc2 applied in: langfuse 3.225.9-r0

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YB63066 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-GL35722 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-AH49048 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-NC17726 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-QL19617 fast-uri serializes the port component of a URI without validating it

Security vulnerability affects the langfuse package. fast-uri serializes the port component of a URI without validating it...

CLEANSTART-2026-EU68751 Security fix for GHSA-f4xh-w4cj-qxq8 applied in: langfuse 3.225.9-r0

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YR10396 fast-uri before 4

Security vulnerability affects the langfuse package. fast-uri before 4...

CLEANSTART-2026-XJ20290 undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON

CVE-2026-84961 affects multiple packages. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. See references for individual vulnerability details...

CLEANSTART-2026-HM32228 Security fix for GHSA-6vj9-mwq6-2f5v applied in: langfuse 3.225.9-r1

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EF09079 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

CVE-2026-101912 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-FP38889 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

CVE-2026-101911 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-KI93866 brace-expansion library generates arbitrary strings containing a common prefix and suffix

CVE-2026-102278 affects multiple packages. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. See references for individual vulnerability details...

CLEANSTART-2026-MC48922 brace-expansion library generates arbitrary strings containing a common prefix and suffix

CVE-2026-102276 affects multiple packages. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. See references for individual vulnerability details...

CLEANSTART-2026-ME50166 brace-expansion library generates arbitrary strings containing a common prefix and suffix

CVE-2026-102277 affects multiple packages. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. See references for individual vulnerability details...

CLEANSTART-2026-FC45371 Security fix for CVE-2026-101899 applied in: langfuse 3.225.9-r5

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-AS30225 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

CLEANSTART-2026-CM96340 Security fix for GHSA-vcvr-r3jv-pc5j applied in: langfuse 3.225.9-r4

Security vulnerability affects the langfuse package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-VD98265 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon

Security vulnerability affects the langfuse package. @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon...

CLEANSTART-2026-MF48068 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-MZ38704 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-YP57972 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-XT17463 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-OV09426 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-SF41732 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-OW20688 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-DD48515 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...

CLEANSTART-2026-DN65952 Axios is a promise-based HTTP client for the browser and Node

Security vulnerability affects the langfuse package. Axios is a promise-based HTTP client for the browser and Node...