This advisory covers several security vulnerabilities in the Node.js 18 module and related components on Red Hat Enterprise Linux 8. The fixed issues include: a denial of service caused by CONTINUATION frames (CVE-2024-27983), a denial of service triggered by using the fetch() function to retrieve content from untrusted URLs (CVE-2024-22025), HTTP request smuggling via content length obfuscation (CVE-2024-27982), a CONTINUATION frames DoS in nghttp2 (CVE-2024-28182), and an out-of-bounds read in the c-ares library (CVE-2024-25629). Red Hat has released updated packages for multiple architectures and variants of RHEL 8 to address these vulnerabilities. The advisory references the Red Hat article for update instructions and lists bugzilla entries for each fix.

The vulnerabilities collectively allow denial of service conditions and memory safety issues that could disrupt Node.js applications or services relying on affected components. Specifically, denial of service can be triggered by malformed HTTP/2 CONTINUATION frames, untrusted URL fetches, and HTTP request smuggling techniques. The out-of-bounds read in c-ares could lead to crashes or potential information disclosure. These impacts affect the availability and reliability of applications using the vulnerable Node.js 18 module on Red Hat Enterprise Linux 8.

Red Hat has released updated nodejs:18 packages for Red Hat Enterprise Linux 8 and its variants that address these vulnerabilities. Users should apply the security update RHSA-2024:2780 promptly by following the instructions in the Red Hat advisory at https://access.redhat.com/articles/11258. Applying the official update is the recommended remediation. No additional mitigations are specified or required beyond installing the provided patches.