Red Hat Security Advisory: nodejs:18 security update
Multiple security vulnerabilities affecting Node.js 18 and related components in Red Hat Enterprise Linux 9 have been addressed in an important security update. The issues include denial of service (DoS) vulnerabilities via CONTINUATION frames and the fetch() function, HTTP request smuggling via content length obfuscation, and an out-of-bounds read in the c-ares library. These vulnerabilities could lead to service disruption or crashes. Red Hat has released updates to fix these issues for various Red Hat Enterprise Linux 9 variants and architectures.
AI Analysis
Technical Summary
The advisory covers five security fixes affecting Node.js 18 and related libraries on Red Hat Enterprise Linux 9. These include CVE-2024-22025, where using the fetch() function to retrieve content from an untrusted URL can cause denial of service; CVE-2024-27983 and CVE-2024-28182, which involve denial of service via CONTINUATION frames in Node.js and nghttp2 respectively; CVE-2024-27982, an HTTP request smuggling vulnerability via content length obfuscation in Node.js; and CVE-2024-25629, an out-of-bounds read in the c-ares library's ares__read_line() function. Red Hat has released updated packages to address these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities can lead to denial of service conditions or memory corruption in affected Node.js environments on Red Hat Enterprise Linux 9. The HTTP request smuggling vulnerability could allow attackers to interfere with HTTP request processing. The out-of-bounds read may lead to application crashes or potential information disclosure. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated Node.js 18 module packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update RHSA-2024:2779 as soon as possible to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor beyond applying the official update.
Red Hat Security Advisory: nodejs:18 security update
Description
Multiple security vulnerabilities affecting Node.js 18 and related components in Red Hat Enterprise Linux 9 have been addressed in an important security update. The issues include denial of service (DoS) vulnerabilities via CONTINUATION frames and the fetch() function, HTTP request smuggling via content length obfuscation, and an out-of-bounds read in the c-ares library. These vulnerabilities could lead to service disruption or crashes. Red Hat has released updates to fix these issues for various Red Hat Enterprise Linux 9 variants and architectures.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory covers five security fixes affecting Node.js 18 and related libraries on Red Hat Enterprise Linux 9. These include CVE-2024-22025, where using the fetch() function to retrieve content from an untrusted URL can cause denial of service; CVE-2024-27983 and CVE-2024-28182, which involve denial of service via CONTINUATION frames in Node.js and nghttp2 respectively; CVE-2024-27982, an HTTP request smuggling vulnerability via content length obfuscation in Node.js; and CVE-2024-25629, an out-of-bounds read in the c-ares library's ares__read_line() function. Red Hat has released updated packages to address these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities can lead to denial of service conditions or memory corruption in affected Node.js environments on Red Hat Enterprise Linux 9. The HTTP request smuggling vulnerability could allow attackers to interfere with HTTP request processing. The out-of-bounds read may lead to application crashes or potential information disclosure. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated Node.js 18 module packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update RHSA-2024:2779 as soon as possible to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:2779
- Cve Count
- 5
- Additional Cves
- ["CVE-2024-25629","CVE-2024-27982","CVE-2024-27983","CVE-2024-28182"]
- Cvss Version
- null
Threat ID: 6a419cc027e9c79719ac08d2
Added to database: 06/28/2026, 22:14:24 UTC
Last enriched: 06/28/2026, 22:40:21 UTC
Last updated: 07/03/2026, 13:51:10 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.