This advisory covers two vulnerabilities in the nodejs:18 module distributed by Red Hat for Red Hat Enterprise Linux 9. CVE-2024-28863 is a denial of service vulnerability in the node-tar package caused by insufficient validation of folder depth during tar file parsing. CVE-2024-22020 allows bypassing network import restrictions through crafted data URLs in Node.js. Red Hat has released an update for nodejs:18 to address these issues across various supported architectures and extended update support versions. The advisory is rated as moderate severity by Red Hat Product Security. No CVSS score is provided in the advisory, but the issues are considered impactful enough to warrant an update.

Successful exploitation of CVE-2024-28863 could cause denial of service by crashing or hanging applications that parse malicious tar files. CVE-2024-22020 could allow an attacker to bypass network import restrictions, potentially enabling unauthorized code imports via data URLs. Both vulnerabilities affect Node.js applications running on Red Hat Enterprise Linux 9 and could impact the reliability and security of network applications built on this platform.

Red Hat has released an official security update for the nodejs:18 module that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9 should apply the update as described in the Red Hat advisory RHSA-2024:6147 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the denial of service and network import bypass issues. No additional mitigation steps are indicated by the vendor.