Red Hat issued a security advisory (RHSA-2026:9874) for Node.js 20 on Red Hat Enterprise Linux 9.6 EUS, addressing four denial of service vulnerabilities: CVE-2026-21710 (Node.js denial of service via crafted HTTP __proto__ header), CVE-2026-26996 (minimatch denial of service via specially crafted glob patterns), CVE-2026-27904 (minimatch denial of service via catastrophic backtracking in glob expressions), and CVE-2026-27135 (nghttp2 denial of service via malformed HTTP/2 frames after session termination). The advisory provides updated packages to remediate these issues. The CVSS vector for CVE-2026-21710 indicates network attack vector, low complexity, no privileges or user interaction required, and a high impact on availability.

Successful exploitation of these vulnerabilities can cause denial of service conditions, impacting the availability of affected Node.js applications and services. There is no indication of confidentiality or integrity impact. The vulnerabilities can be triggered remotely without authentication or user interaction.

Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the available security update as detailed in Red Hat advisory RHSA-2026:9874 and the referenced article https://access.redhat.com/articles/11258. Applying this update mitigates the denial of service vulnerabilities. No additional mitigation steps are indicated by the vendor.