This advisory covers two security vulnerabilities in Node.js as packaged by Red Hat for Red Hat Enterprise Linux 9.0. CVE-2024-27982 involves HTTP Request Smuggling through Content Length obfuscation, which can lead to request handling anomalies. CVE-2024-27983 is a Denial of Service vulnerability triggered by CONTINUATION frames. Red Hat has released updated Node.js packages (version 16.20.2-6.el9_0) to address these issues. The advisory references bug fixes BZ-2275392 and BZ-2272764 for these CVEs respectively. No CVSS scores are provided in the advisory.

The vulnerabilities could allow an attacker to perform HTTP request smuggling attacks, potentially leading to unexpected request handling behavior, and cause denial of service conditions via malformed CONTINUATION frames. The advisory rates the overall security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated Node.js packages for Red Hat Enterprise Linux 9.0 that fix these vulnerabilities. Users should apply these updates promptly. Before applying this update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available from Red Hat's documentation. No additional mitigation steps are indicated beyond applying the official update.