The advisory covers five security fixes affecting Node.js 18 and related libraries on Red Hat Enterprise Linux 9. These include CVE-2024-22025, where using the fetch() function to retrieve content from an untrusted URL can cause denial of service; CVE-2024-27983 and CVE-2024-28182, which involve denial of service via CONTINUATION frames in Node.js and nghttp2 respectively; CVE-2024-27982, an HTTP request smuggling vulnerability via content length obfuscation in Node.js; and CVE-2024-25629, an out-of-bounds read in the c-ares library's ares__read_line() function. Red Hat has released updated packages to address these vulnerabilities.

Successful exploitation of these vulnerabilities can lead to denial of service conditions or memory corruption in affected Node.js environments on Red Hat Enterprise Linux 9. The HTTP request smuggling vulnerability could allow attackers to interfere with HTTP request processing. The out-of-bounds read may lead to application crashes or potential information disclosure. No known exploits in the wild have been reported at this time.

Red Hat has released updated Node.js 18 module packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update RHSA-2024:2779 as soon as possible to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor beyond applying the official update.