6.5.1

Platform 6.5.1 is a maintenance release with security updates, bug fixes, and enhancements across FlowAI (Agent Projects, Agent Sessions, Model Registry), Work Center, Studio, Configuration Manager, NSO Service Manager, and Platform infrastructure. It addresses customer-reported issues and improves stability, reliability, and security across the platform.

ComponentFeatureDescription
Admin EssentialsUpdated Gateway terminology (ENG-25258)Updated the Gateway configuration page in Admin Essentials to use current product naming (Itential Gateway/Gateway 5) instead of IAG/IAG5.
Agent ProjectsStay in Agent Editor after save (ENG-25870)When creating a new agent, clicking Save Agent or Save and Run Agent now keeps you in Agent Editor instead of navigating to the read-only Agent Details view, matching the existing behavior when editing an agent.
Agent ProjectsUpdated Agent Details field styling (ENG-25901)Updated the read-only agent details view’s field styling to align with the latest design, including removing lock icons and adding a tooltip explaining that changes must be made when editing an agent.
Agent ProjectsDelete agent from Agent Editor (ENG-25992)You can now delete an agent directly from the agent editor, not just from the details page.
Agent SessionsLeft-aligned instructions link (ENG-24952)The link back to the top of the agent session is now left-aligned with the surrounding content.
Agent SessionsOptional session token count column (ENG-25050)Added an optional Total Output Token column to the Agent Sessions table, with sorting and filtering support.
Agent SessionsCustom task summary for agent-created tasks (ENG-25051)Agent sessions can now set a manual task’s task summary, similar to existing workflow behavior, so operators see meaningful context in Work Center instead of a generic task name.
Agent SessionsSmooth animation for tools/reasoning panels (ENG-25289)The collapse and expand transition for tools and reasoning in Agent Sessions now animates smoothly with ease-in and ease-out instead of jumping.
Agent SessionsStandardized tool call and reasoning timers (ENG-25290)Standardized the time tracker position for tool calls and reasoning in Agent Sessions, and the timer now updates live while a tool call or reasoning step is running.
Agent SessionsAnchored scroll for expanded conclusions (ENG-25471)Opening a completed agent session now anchors the expanded view to the top of the agent conclusion instead of opening at the bottom of a long session.
Agent SessionsFaster agent session list performance (ENG-26330)Improved Agent Sessions list query performance with index fixes for the default view and the trigger.source filter, reducing multi-second load times without changing which sessions are visible.
Configuration Manager EnterpriseDraft mode for compliance plans (ENG-20223)You can now save a compliance plan as a draft and return to it later. A plan saved as a draft cannot be run until it is finalized.
CoreSHA checksum files for release packages (ENG-16404).sha256 checksum files are now published for the itential-platform, itential-configuration_manager, and itential-lifecycle_manager RPM packages, so you can verify that a downloaded package matches what we published and hasn’t been altered or corrupted in transit.
FlowAIOpenInference tracing endpoint (ENG-24313)Added an OpenInference endpoint to the FlowAI for execution tracing.
FlowAIRemoved Tool deny list (ENG-25955)Removed deny list, which previously prevented certain methods from being used as Tools.
FlowAIFlowAI returns created asset ID (ENG-26008)FlowAI responses for asynchronous tool executions now include an artifactId, the ID of the created asset instance (for example, a work item, job, or session), so the execution engine can link directly to that asset.
Gateway ManagerMosaic design system UI update (ENG-21262)Updated Gateway Manager to use Primereact Mosaic components, including the status indicator and tables.
Gateway Manager, Inventory ManagerMosaic left navigation (ENG-21962)Inventory Manager and Gateway Manager now use the Mosaic left navigation, so these apps are no longer affected by conflicting styles across pages.
NSO Service ManagerTrace-id support for NSO transactions (ENG-23913)The NSO adapter now supports trace IDs across JSON-RPC, RESTCONF, and NETCONF request formats, improving end-to-end traceability and troubleshooting between Platform adapter calls and the corresponding NSO transaction.
Operations Manager, Workflow EngineOne-click session link from Run Agent task (ENG-24778)Added a link from the Run Agent task on canvas that opens the agent session directly in a new tab, following the same pattern as the Child Job task.
Workflow EngineTask worker thread count (ENG-23342)You can now configure task worker thread count to control the number of background worker threads available for task processing. For more information, see Task worker thread count
Work CenterRemoved standalone mode (ENG-24850)Removed Work Center’s standalone mode. Work Center now requires integration with other Platform services.
Work CenterCollapsed view by default (ENG-25742)Work Center now defaults to a collapsed view. Details expand only when you explicitly select them.
ComponentFeatureDescription
Admin Essentials403 toasts when deleting adapters on Essentials/Compliance (ENG-25279)Fixed an issue where deleting an adapter or integration in Admin Essentials on Essentials or Compliance tiers triggered authorization-error toasts from dependency checks in Studio and JSON Forms, even though the delete succeeded. A generic dependency warning is now shown instead.
Agent ProjectsEnd Time column sort fixed (ENG-25835)Fixed an issue where sorting the Agent Sessions table by the End Time column silently sorted by Started At instead. Sorting by End Time now correctly requests endedAt.
Agent ProjectsClient-side pagination for agent lists (ENG-24653)Added a paginated table footer to the agent list in Agent Projects instead of rendering all agents at once.
Agent ProjectsPersistent project association labels (ENG-24820)Fixed an issue where an asset’s project association label (for example, Admin Workflow (from Test Admin Permission Project)) was dropped after a page refresh. Assets that belong to a project now consistently show their project association.
Agent ProjectsConsistent error message styling (ENG-25015)Fixed inconsistent styling between permission and not-found error messages in Agent Projects.
Agent ProjectsPermission tooltips on disabled project settings (ENG-25030)Updated the no-permission tooltips and disabled styling for Permissions controls (checkboxes, role radio buttons, and remove/trash icons) in Agent Project Settings, so each disabled control appears dimmed and shows a tooltip explaining why it’s disabled.
Agent ProjectsAccessibility focus borders on input fields (ENG-25093)Focus state styling is now applied consistently across input fields in the Agent Projects UI, including Job Viewer and Insights.
Agent ProjectsTooltip position near screen edge (ENG-25116)Fixed an issue where permission tooltips in Agent Project Settings rendered off-center when a control was too close to the edge of the screen for the tooltip to center correctly.
Agent ProjectsDecorator dialog title update (ENG-25436)Updated the Create Decorator dialog title from “Create a Decorator” to “Create Decorator.”
Agent ProjectsPage jump when editing long prompts (ENG-25437)Fixed an issue where clicking and typing near the end of a long agent prompt caused the page to scroll, landing content behind the sticky header. The Agent Editor prompt field now uses a fixed height with a scrollbar for overflow text.
Agent ProjectsConsistent agent list action tooltips (ENG-25440)Fixed inconsistent tooltip styling between the delete agent and clone agent buttons in the agent list Actions column.
Agent ProjectsRemoved non-functional search parameter (ENG-25585)Removed the non-functional Search query parameter from the list FlowAI projects API.
Agent ProjectsPersistent save confirmation toast (ENG-25633)The “Agent saved.” toast shown after clicking Save and Run Agent now persists until manually dismissed instead of auto-dismissing after a few seconds.
Agent ProjectsFixed-height, non-resizable prompt field (ENG-25720)The agent prompt text field is no longer manually resizable. It now uses a fixed height of 24 rows with a scrollbar for overflow text, reducing screen overload.
Agent ProjectsRemove unauthorized tools from an agent (ENG-25749)Fixed an issue where an unauthorized tool referenced by an imported or copied agent couldn’t be removed from the Agent Definition in the UI. Removing an unauthorized tool is now tracked locally and persisted correctly when the agent is saved.
Agent SessionsFilter bar shift on expand/collapse (ENG-25288)Fixed an issue where the filters in the top right of Agent Sessions shifted position when expanding or collapsing the page.
Agent SessionsFixed Checkbox and Actions columns (ENG-25355)Fixed an issue where the fixed Checkbox and Actions columns in the Agent Sessions table could be indirectly reordered by moving other columns around them.
Agent Sessions”Today” button in Range date filter (ENG-25433)Fixed an issue where clicking Today in the End Time Range filter always set the start date, producing an empty date range. The button now correctly sets the range to 12 AM through 11:59 PM of the current day.
Agent SessionsRange filter overflow for End Time (ENG-25731)Fixed an issue where selecting the Range filter for End Time opened past the visible page, requiring horizontal scrolling to see the cut-off filter.
Claim Check InterfaceClaimCheck GridFS fallback (ENG-26106)Fixed an issue where ClaimCheck.store() did not fall through to the GridFS streaming path for large payloads when MongoDB returned an offset is out of bounds size error, causing an unnecessary failure instead.
Configuration ManagerConfig Manager crash from bad Agent tool call (ENG-25486)Fixed an issue where an invalid Agent tool call could crash Configuration Manager.
CoreAdapter import via Swagger UI/API (ENG-16929)Fixed an issue where importing an adapter through the /adapters/import API, as opposed to the UI, failed because the request properties were not parsed correctly.
CoreWebServer input session token leak (ENG-24070)Fixed an issue where IAP’s WebServer could return the session token in place of a missing input value when an input’s schema did not define schema.properties.
CoreSNMP traps for service stop and crash (ENG-24868)Fixed an issue where the itenProngAppDown and itenProngAppCrash SNMP traps were not sent when the platform stopped gracefully or crashed, under certain conditions.
FlowAIAutomatic retry for invalid tool inputs (ENG-26007)Fixed an intermittent issue where invalid tool inputs caused some FlowAI tool calls, including ViewData, to fail. Inference is now automatically retried up to 3 times after invalid tool inputs.
FlowAISearch and filter for tools in a project (ENG-25299)Added the ability to find tools that live inside a studio or agent project through search and type filtering, instead of only being discoverable by expanding their parent project.
FlowAI”Tools can’t be reached” for existing IAG5 services (ENG-25826)Fixed an issue where Gateway Service tool reference IDs weren’t stable, causing broken tool references and a “One or more tools can’t be reached” warning for existing IAG5 services even when the agent showed a “Ready to Launch” status.
FlowAINull description guard for tool transformers (ENG-25302)Fixed an issue where tools with no description (transformations, compliance plans, agents, analytic templates, command templates, and JSON forms) stored a null description, which caused a 400 error from the Anthropic API and prevented sessions from starting when an agent tried to use the tool.
Gateway ManagerBlank GUI in Run Service task (ENG-26217)Fixed an issue where selecting certain services within the Run Service task in Studio caused the browser to go blank.
Gateway Manager, IntegrationsDynamic API-key retrieval for gateway-routed integrations (ENG-25488)Fixed an issue where an Integration using an API key security scheme with dynamic retrieval (x-itential-dynamic-retrieval) did not retrieve or refresh the token when the request was routed through a gateway, causing the target to reject the request.
Golden ConfigurationJSON Compliance Check from Golden Configuration tree (ENG-25673)Fixed an issue where running a JSON Compliance check from the Golden Configuration tree reported success but failed to generate the compliance report.
IntegrationsAuthorization roles for imported Integration Models (ENG-25174)Fixed an issue where importing an OpenAPI-based Integration Model containing circular schema references in request bodies could silently fail to complete its setup, which prevented the corresponding Authorization role entries from being created.
itential-utilsCyberArk CCP secret retrieval timeout (ENG-24156)Fixed an issue where incorrectly configured timeouts caused failures when retrieving secrets from CyberArk CCP.
JSON FormsInvalid JSON Form creation via API (ENG-18045)Added server-side validation to POST /json-forms/forms to prevent creating a JSON Form missing the required items property, which previously left the form in an unrecoverable, uneditable state.
JSON FormsJSON form manual task payload timing (ENG-21716)Fixed a timing issue where a JSON form manual task could render with stale payload data when a job variable used in the form was updated shortly before the form was displayed.
JSON FormsJSON form stale data across executions (ENG-26052)Fixed a bug in the Form Preview dialog where a JSON form with overlapping schema combinations could show stale data, including a previously selected combination option and previously entered data, from an earlier execution when the view was toggled between the form and its submitted data.
JSON Forms, PlatformArray table validation after row deletion (ENG-24301)Fixed an issue where a JSON Form array/table field retained a validation error after deleting a row with an unresolved dynamic dropdown value, which left the form unsubmittable even though the remaining data was valid.
JSON Forms, Templates, Transformations, WorkflowsClone dialog not closing (ENG-24942)Fixed an issue where the clone dialog did not close after cloning an asset from the Studio collection view. The collection view now also updates to show the newly cloned document.
Model RegistryColumn selector icon corrected (ENG-25123)Corrected the icon used for the column selector button in the Model Registry profiles table so it matches the Agent Sessions table.
Model RegistryProfile form autofill and cursor fixes (ENG-25125)Prevented browser autocomplete from filling the Name and API Key fields in the Create Profile and Edit Profile dialogs, and fixed the API Key field showing a pointer cursor instead of a text cursor on hover.
Model RegistryClearer error for invalid model variables (ENG-25131)Fixed an issue where saving non-object JSON in the Model Variables field showed an opaque “Failed to update profile” error with no indication that the value must be an object.
Model RegistryAffected Agents list sort order (ENG-25157)Added a default alphabetical sort order to the Affected Agents list for a model profile in Model Registry.
Model RegistryUpdated search placeholder text (ENG-25184)Updated the search bar placeholder text on the Model Registry list view.
NSO Service ManagerNSO adapter nonexistent device cache (ENG-25784)Added an enableNonExistentDeviceCache configuration option to control the NSO adapter’s negative device cache, improving device lookup reliability. This option is enabled by default.
Operations ManagerForEach iteration navigation while job running (ENG-25145)Fixed an issue where the job details table could not navigate to a selected forEach iteration’s task details while the job was still running.
Operations ManagerQuick Form rendering in Operations Manager (ENG-25409)Operations Manager now links to Work Center to complete a Quick Form manual task instead of rendering a blank page.
Operations Manager, Workflow EngineView Diff task scroll sync (ENG-8051)Fixed a regression in the View Diff task where the two comparison panes scrolled independently instead of staying locked together, making review more difficult.
ProjectsComponent add mode option clarification (ENG-8275)Updated the documentation for the POST /automation-studio/projects/{projectId}/components/add endpoint to clarify the supported values and behavior of the mode option.
ProjectsTransformations tab visibility in Project Builder (ENG-9709)Added a visual indicator for tab overflow in Project Builder, so it’s clear when additional tabs, such as Transformations, are available but not currently visible on smaller screens.
Projects, TransformationsHorizontal scrollbar in Transformation functions (ENG-22777)Fixed an issue where the horizontal scrollbar did not appear within a Transformation function’s canvas when the Transformation was created inside a Project.
StudioSearch bar Enter key behavior (ENG-21750)Fixed an issue where pressing Enter in a left-navigation search box across Platform apps could open an empty suggestions overlay.
StudioDeep Merge false value rendering (ENG-23288)Fixed inconsistent rendering of blank, null, and empty object values in the Deep Merge task editor.
StudioHardcoded docs.itential.io links (ENG-24891)Removed hardcoded links to docs.itential.io and replaced them with docs.itential.com.
StudioRBAC on task copy/paste (ENG-25423)Fixed an issue where users could copy or paste workflow tasks they didn’t have RBAC permission to use via copy, copy selection, or Ctrl+C. Users can no longer copy tasks they lack access to at design time.
StudioDebug menu overlay in new workflows (ENG-25684)Fixed an issue in Studio where the debug mode overlay could persist and appear on a newly created or opened workflow.
StudioWorkflow undo history exhaustion (ENG-25746)Fixed an issue where pressing Cmd+Z after exhausting the current session’s undo history could remove existing task connections or reposition tasks unexpectedly, including after a page reload.
StudioConcat task object variable support (ENG-25893)The task input type label in Studio now reflects the actual accepted schema type instead of always showing Any, preventing job variables of incompatible types, such as Object, from being bound to inputs that don’t support them.
StudioStudio crash on malformed workflow (ENG-25966)Fixed an issue where opening a workflow with invalid or missing task position data crashed Studio with an Invalid arguments to Point constructor error.
StudioStale Run Service task parameters (ENG-26030)Fixed an issue where changing a Gateway Manager service’s decorator schema left stale, orphaned parameter keys in a saved runService task, which could cause execution to fail when the new decorator disallowed additional properties.
TemplatesDuplicate requests from Edit dialog (ENG-24363)The Edit Details dialog’s Save and Cancel buttons are now disabled while a save is in progress, preventing duplicate update requests on Analytic and Command Templates during slow-network saves.
TransformationsDate-time modification in Transformation (ENG-6892)Fixed an issue where modifying a date-time string in a Transformation, for example using setUTCMinutes, did not update the value as expected.
TransformationsJST if/else statement limit (ENG-8449)Fixed an issue where a JST could not correctly connect a context to more than 10 if/else conditions.
TransformationsTernary operator space input (ENG-9375)Fixed an issue where entering a single space in the ternary operator’s exprIfTrue or exprIfFalse input converted the value to 0 instead of preserving the space.
TransformationsMigration script for missing function names (ENG-9944)Fixed a regression where importing a Transformation containing a function with a missing name property no longer auto-generated the missing name, which caused callback dropdowns to display as undefined.
TransformationsBroken help link on query object (ENG-12360)Fixed a broken documentation link on the Query task’s info button in JST Designer.
TransformationsMissing $id validation in JST Designer (ENG-12870)Fixed an issue where JST Designer’s warning for a missing $id did not display correctly, and moved the error message inside the editor to be consistent with other error messages.
TransformationsJST function schema type mismatch (ENG-17988)Fixed an issue where changing the incoming or outgoing schema of a user function dragged onto a JST canvas did not update or validate existing assignments. Changing a function’s parameter type now disconnects any existing assignment and displays an error about the mismatched types.
Work CenterQuick Form Complete Task button state (ENG-25291)Fixed an issue where the Complete Task button in a Quick Form did not enable or disable immediately as required text fields were filled in or cleared.
Work CenterQuickForm with empty parameters (ENG-26149)Fixed an issue where launching a QuickForm with no rows to review left the task stuck with no visible content or Complete button. Operators can now complete these tasks normally, and when a task’s configuration hides all data columns but rows are still present, the task now displays the action column with a warning message instead of an empty table.
Work CenterOverlapping filter dropdowns (ENG-25849)Fixed an issue where filter dropdowns in Job Viewer, Work Center, Insights, and Session Manager could remain open and overlap when opened sequentially.
Work CenterWork Center service boot failure (ENG-26021)Fixed an issue where Work Center Service could fail to start due to an unhandled exception from the provider PLATFORM_PRONGHORN, which has now been removed.
Workflow EngineDeeper workflow validation (ENG-24167)Workflow validation now catches broken task references left over after a task is deleted, putting the workflow in draft status instead of allowing it to run with missing or incorrect data.
Workflow EngineManual task status after job completion (ENG-25152)Fixed an issue where a reverted job’s canvas and task list could continue to display a manual task as running after the job had completed.
Workflow EngineDuplicate taskErrored events (ENG-25701)Fixed two issues with the Workflow Engine’s taskErrored and taskStarted system events: a task failure could publish a duplicate taskErrored event, and a non-scheduled task that failed due to a failed inline-query decorator never published its corresponding taskStarted event.
WorkflowsValid workflows not opening after mixed import (ENG-24310)Fixed an issue where importing multiple workflows at once, when one or more failed validation, prevented the successfully imported workflows from opening in the editor.
WorkflowsTask palette unauthorized requests in cloud (ENG-25351)Fixed an issue where hovering over a task in the Studio task palette or Swap Task panel triggered an unauthenticated documentation lookup, which returned 403 errors in RBAC-restricted and cloud environments.
WorkflowsAdapter Model job variable error (ENG-25528)Fixed an issue where setting an adapter task’s Adapter Model to a job variable and saving the workflow produced a Cannot find match for input: "Adapter Id" error.
WorkflowsRun Service task toggle caching (ENG-25646)Fixed an issue where the runService task’s Use as Variable toggle for Gateway Cluster ID and Service reflected the state of another workflow’s runService task when tasks shared the same task ID, for example after export/import.

This release includes security updates that address vulnerabilities in third-party packages and platform components.

ComponentFeatureDescription
Agent SessionsInefficient algorithmic complexity in js-yaml (Agent Sessions) (ENG-25748)Updated the nestjs-platform dependency in Agent Sessions to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in js-yaml’s YAML merge-key handling.
Agent SessionsDirectory traversal in fast-uri (ENG-25634)Updated the fast-uri dependency in Agent Sessions to resolve a directory traversal vulnerability.
Agent SessionsResource allocation limit in body-parser (ENG-25747)Updated the body-parser dependency (via express) in Agent Sessions to resolve a vulnerability (CVE-2026-12590) that allowed unbounded request body sizes when the configured limit option failed to parse.
Agent SessionsCRLF injection in form-data (ENG-25798)Updated the form-data dependency in Agent Sessions to resolve a CRLF injection vulnerability.
Agent SessionsInterpretation conflict in fast-uri (update) (ENG-26022)Updated the fast-uri dependency in Agent Sessions to resolve an additional interpretation conflict vulnerability (CVE-2026-16221) involving backslash handling in hostnames.
CoreCross-site scripting in Core (ENG-2631)Resolved a cross-site scripting (XSS) vulnerability in Core by improving the security of authentication failure responses so they can’t be rendered as HTML by the browser.
CoreInterpretation conflict in fast-uri (Core) (ENG-25399)Updated the fast-uri dependency in Core to resolve an interpretation conflict vulnerability (CVE-2026-13676) that could allow host-based security policies to be bypassed via internationalized hostnames.
CoreInefficient algorithmic complexity in brace-expansion (Core) (ENG-25462)Updated the brace-expansion dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149) that could cause excessive CPU consumption via crafted input.
CoreInefficient algorithmic complexity in immutable (Core) (ENG-25762)Updated the immutable dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59880) in Immutable.Map and Immutable.Set hash collision handling.
CoreInefficient algorithmic complexity in js-yaml (Core) (ENG-25764)Updated the js-yaml dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in YAML merge-key handling.
CoreAllocation of resources without limits in ws (Core) (ENG-25971)Updated the ws dependency in Core to resolve an allocation-of-resources-without-limits vulnerability (CVE-2026-62389) that could cause memory exhaustion via incomplete fragmented WebSocket messages.
CoreInterpretation conflict in fast-uri (Core, backslash handling) (ENG-26031)Updated the fast-uri dependency in Core to resolve an interpretation conflict vulnerability (CVE-2026-16221) that could allow host-based validation to be bypassed via a URI containing a literal backslash.
FlowAIInterpretation conflict in fast-uri (ENG-25650)Updated the fast-uri dependency in FlowAI to resolve a hostname interpretation conflict vulnerability that could allow host-based security checks to be bypassed.
FlowAI, Model RegistryEncrypted profile credential storage (ENG-25554)Resolved a security issue where FlowAI agent profile credentials (clientSecret and apiKey, including BYOL credentials passed through the gateway) were stored in MongoDB in clear text instead of encrypted.
Inventory ManagerInventory Manager security cleanup (ENG-26064)Resolved medium-severity security vulnerabilities in Inventory Manager.
Inventory ManagerInventory Adapter security cleanup (ENG-26065)Resolved medium-severity security vulnerabilities in the Inventory Manager adapter.
itential-utilsInefficient algorithmic complexity in brace-expansion (itential-utils) (ENG-25647)Updated the minimatch and brace-expansion transitive dependencies under javascript-obfuscator in itential-utils to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149).
itential-utilsInterpretation conflict in fast-uri (itential-utils) (ENG-25648)Updated the fast-uri dependency in itential-utils to resolve an interpretation conflict vulnerability (CVE-2026-13676).
NSO Service ManagerInefficient algorithmic complexity in brace-expansion (Service Management) (ENG-25607)Updated the brace-expansion dependency in Service Management (app-service_management) to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149).
NSO Service ManagerInterpretation conflict in fast-uri (Service Management) (ENG-25608)Updated the fast-uri dependency in Service Management (app-service_management) to resolve an interpretation conflict vulnerability (CVE-2026-13676).
NSO Service ManagerCRLF injection in form-data (Service Management) (ENG-25609)Updated the form-data dependency in Service Management (app-service_management) to resolve a CRLF injection vulnerability (CVE-2026-12143).
NSO Service ManagerCross-site scripting in dompurify (Service Management) (ENG-25610)Updated the dompurify dependency in Service Management (app-service_management) to resolve a cross-site scripting vulnerability (CVE-2026-65900) in the SAFE_FOR_TEMPLATES function.
NSO Service ManagerInefficient algorithmic complexity in brace-expansion (NSO Manager) (ENG-25611)Updated the brace-expansion dependency in app-nso_manager to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149).
NSO Service ManagerInterpretation conflict in fast-uri (NSO Manager) (ENG-25612)Updated the fast-uri dependency in app-nso_manager to resolve an interpretation conflict vulnerability (CVE-2026-13676).
NSO Service ManagerCRLF injection in form-data (NSO Manager) (ENG-25613)Updated the form-data dependency in app-nso_manager to resolve a CRLF injection vulnerability (CVE-2026-12143).
NSO Service ManagerCross-site scripting in dompurify (NSO Manager) (ENG-25614)Updated the dompurify dependency in app-nso_manager to resolve a cross-site scripting vulnerability (CVE-2026-65900) in the IN_PLACE sanitization process.
NSO Service ManagerInefficient algorithmic complexity in brace-expansion (adapter-nso) (ENG-25615)Updated the brace-expansion dependency in adapter-nso to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149).
NSO Service ManagerInterpretation conflict in fast-uri (adapter-nso) (ENG-25616)Updated the fast-uri dependency in adapter-nso to resolve an interpretation conflict vulnerability (CVE-2026-13676).
NSO Service ManagerCRLF injection in form-data (adapter-nso) (ENG-25617)Updated the form-data dependency in adapter-nso to resolve a CRLF injection vulnerability (CVE-2026-12143).
Operations ManagerBlind NoSQL injection in Operations Manager (ENG-25628)Resolved a blind NoSQL (MongoDB) injection vulnerability in Operations Manager’s triggers and jobs APIs.
PlatformInterpretation conflict in fast-uri (ENG-25649)Updated the fast-uri dependency to resolve an interpretation conflict vulnerability (CVE-2026-13676).
Work CenterUncontrolled recursion in multer (ENG-25626)Updated the multer dependency in Work Center Service to resolve an uncontrolled recursion vulnerability that could allow CPU and memory exhaustion via deeply nested multipart form field names.
Work CenterInefficient algorithmic complexity in js-yaml (Work Center Service) (ENG-25735)Updated the nestjs-platform dependency in Work Center Service to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in js-yaml’s YAML merge-key handling.
Work CenterInefficient algorithmic complexity in js-yaml (nestjs-platform) (ENG-25737)Updated the js-yaml dependency in Work Center’s nestjs-platform library to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869).
Work CenterAllocation of resources without limits in body-parser (Work Center) (ENG-25765)Updated the axios dependency and its transitive dependencies (qs, form-data) in Work Center to resolve a medium-severity denial-of-service vulnerability (CVE-2026-12590) in body-parser’s request body size limit handling. No functional or behavioral changes.
ComponentVersion
Configuration Manager Enterprise6.5.1
FlowAI1.0.1
Gateway Manager1.1.2
Inventory Manager1.2.12
NSO Service Manager6.5.1