chainguard/opensearch-dashboards-2

Vulnerabilities (130)

• CVE-2026-67314MedAug 1, 2026
  affected < 2.19.6-r7fixed 2.19.6-r7

  axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios reques

• CVE-2026-65898HigJul 23, 2026
  affected < 2.19.5-r15fixed 2.19.5-r15

  DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror f

• CVE-2026-14257HigJul 23, 2026
  affected < 2.19.6-r6fixed 2.19.6-r6

  brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps

• CVE-2026-12590LowJul 9, 2026
  affected < 2.19.6-r8fixed 2.19.6-r8

  Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that

• CVE-2026-59875MedJul 8, 2026
  affected < 2.19.6-r4fixed 2.19.6-r4

  node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exceptio

• CVE-2026-59874HigJul 8, 2026
  affected < 2.19.6-r4fixed 2.19.6-r4

  node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed

• CVE-2026-59873HigJul 8, 2026
  affected < 2.19.6-r4fixed 2.19.6-r4

  node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to

• CVE-2026-59871MedJul 8, 2026
  affected < 2.19.6-r4fixed 2.19.6-r4

  node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught Type

• CVE-2026-59869HigJul 8, 2026
  affected < 2.19.6-r1fixed 2.19.6-r1

  js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i

• CVE-2026-13149HigJun 30, 2026
  affected < 2.19.6-r1fixed 2.19.6-r1

  brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause sign

• CVE-2026-54285MedJun 22, 2026
  affected < 2.19.6-r15fixed 2.19.6-r15

  opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries

• CVE-2026-53655MedJun 22, 2026
  affected < 2.19.5-r16fixed 2.19.5-r16

  node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Pe

• CVE-2026-53550MedJun 22, 2026
  affected < 2.19.5-r15fixed 2.19.5-r15

  js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior rel

• CVE-2026-12143HigJun 12, 2026
  affected < 2.19.5-r15fixed 2.19.5-r15

  form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line fee

• CVE-2026-44496HigJun 11, 2026
  affected < 2.19.5-r14fixed 2.19.5-r14

  Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments

• CVE-2026-44495HigJun 11, 2026
  affected < 2.19.5-r14fixed 2.19.5-r14

  Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transf

• CVE-2026-44494HigJun 11, 2026
  affected < 2.19.5-r14fixed 2.19.5-r14

  Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-

• CVE-2026-44492HigJun 11, 2026
  affected < 2.19.5-r14fixed 2.19.5-r14

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:

• CVE-2026-44490MedJun 11, 2026
  affected < 2.19.5-r14fixed 2.19.5-r14

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios sil

• CVE-2026-44488HigJun 11, 2026
  affected < 2.19.5-r14fixed 2.19.5-r14

  Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments wh