This advisory covers four denial of service vulnerabilities affecting Node.js 20 as packaged by Red Hat for Enterprise Linux 8. The vulnerabilities include CVE-2026-21710 (Node.js denial of service via crafted HTTP __proto__ header), CVE-2026-26996 and CVE-2026-27904 (minimatch denial of service via specially crafted glob patterns and catastrophic backtracking), and CVE-2026-27135 (nghttp2 denial of service via malformed HTTP/2 frames after session termination). Red Hat has released updated Node.js 20 packages rebased to the latest upstream Node.js 20 release that fix these issues. The advisory references Red Hat Bugzilla entries for each CVE and provides links to updated packages and remediation instructions.

Successful exploitation of these vulnerabilities could cause denial of service conditions in applications using the affected Node.js 20 packages on Red Hat Enterprise Linux 8. This may result in application crashes or resource exhaustion. No evidence of exploitation in the wild is reported. The impact is limited to denial of service; no remote code execution or data breach is indicated.

Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:8339 and the referenced article https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are stated. Patch status is official-fix; applying the update remediates the issues.