Red Hat Product Security issued an advisory (RHSA-2024:6148) for Node.js 18 on Red Hat Enterprise Linux 8 addressing two vulnerabilities: CVE-2024-28863, a denial of service in node-tar due to insufficient folder depth validation when parsing tar files, and CVE-2024-22020, a bypass of network import restrictions via data URLs in Node.js. The advisory provides updated packages to fix these issues. The vulnerabilities have a moderate severity rating. No known exploits in the wild have been reported. The advisory references Red Hat's article on applying the update and lists affected Red Hat Enterprise Linux 8 variants. No explicit CVSS score is provided within the advisory or CVE data. Patch availability is confirmed via the update packages provided by Red Hat.

The denial of service vulnerability in node-tar (CVE-2024-28863) could allow an attacker to cause application or service disruption when parsing crafted tar files. The network import restriction bypass (CVE-2024-22020) could allow unauthorized network imports via data URLs, potentially undermining security controls that restrict network resource loading. Both issues have a moderate security impact as rated by Red Hat. There are no reports of active exploitation in the wild at this time.

Red Hat has released updated nodejs:18 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in Red Hat's advisory RHSA-2024:6148 and the referenced article (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as available.