This advisory covers four security vulnerabilities in Node.js 20 as packaged by Red Hat for RHEL 8. CVE-2024-28863 is a denial of service vulnerability in node-tar caused by lack of folder depth validation when parsing tar files. CVE-2024-22020 allows bypassing network import restrictions via data URLs. CVE-2024-22018 and CVE-2024-36137 involve bypasses of the permission model in Node.js filesystem functions fs.lstat and fs.fchown/fchmod respectively. Red Hat has issued a security update (RHSA-2024:5814) that addresses these issues by updating the nodejs:20 module. The advisory rates the severity as moderate and provides updated packages for multiple RHEL 8 architectures and extended life cycle versions.

The vulnerabilities could lead to denial of service conditions or unauthorized bypass of filesystem permission checks in Node.js applications running on affected Red Hat Enterprise Linux 8 systems. This may allow attackers to circumvent security restrictions or cause application crashes. The overall security impact is rated moderate by Red Hat Product Security.

Red Hat has released an official security update for the nodejs:20 module in Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2024:5814 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated beyond applying the official update.