This advisory covers a set of important security fixes for Node.js modules (versions 22 and 24) distributed with Red Hat Enterprise Linux 8 and 9. The vulnerabilities include CVE-2026-6733 (response queue poisoning on reused keep-alive sockets in undici), CVE-2026-42338 (cross-site scripting in ip-address), CVE-2026-12151 (denial of service via unbounded memory growth in undici), CVE-2026-9678 (information disclosure due to improper cache-control header parsing in undici), CVE-2026-11525 (weakening of cookie SameSite policy in undici), CVE-2026-48619 (denial of service via unlimited HTTP/2 ORIGIN frames), CVE-2026-48930 (silent authority rebinding due to embedded-nul hostnames in TLS handling), CVE-2026-48935 (unauthorized file metadata modification), among others. These vulnerabilities affect multiple components and can lead to denial of service, information disclosure, authentication bypass, and incorrect response delivery. The fixes are included in updated Node.js 22 and 24 module packages rebased to the latest upstream Node.js releases.

The vulnerabilities collectively can cause denial of service conditions, cross-site scripting attacks, information disclosure, authentication bypass, and incorrect response delivery in Node.js applications running on affected Red Hat Enterprise Linux versions. These issues may allow attackers to disrupt services, leak sensitive information, bypass security controls, or manipulate responses, impacting the confidentiality, integrity, and availability of affected systems.

Red Hat has released updated Node.js 22 and 24 module packages for Red Hat Enterprise Linux 8 and 9 that address these vulnerabilities. Users should apply these official security updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.