Red Hat Security Advisory: nodejs22 security update
Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
Red Hat issued a security update for Node.js 22 on Red Hat Enterprise Linux 10 to fix nine denial of service vulnerabilities across several components: brace-expansion (CVE-2026-25547), minimatch (CVE-2026-26996, CVE-2026-27904), undici (CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229), nghttp2 (CVE-2026-27135), and Node.js core (CVE-2026-21710). These vulnerabilities allow denial of service through unbounded resource consumption or malformed input handling such as unbounded brace range expansion, catastrophic backtracking in glob patterns, WebSocket decompression issues, HTTP request smuggling, malformed HTTP/2 frames, and crafted HTTP headers. The advisory references Red Hat's errata RHSA-2026:7080 and provides updated packages to address these issues.
Potential Impact
The vulnerabilities collectively enable denial of service conditions in Node.js environments by exploiting unbounded resource consumption, malformed input handling, and HTTP request smuggling. This can lead to application crashes or service unavailability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:7080 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official update.
Red Hat Security Advisory: nodejs22 security update
Description
Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat issued a security update for Node.js 22 on Red Hat Enterprise Linux 10 to fix nine denial of service vulnerabilities across several components: brace-expansion (CVE-2026-25547), minimatch (CVE-2026-26996, CVE-2026-27904), undici (CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229), nghttp2 (CVE-2026-27135), and Node.js core (CVE-2026-21710). These vulnerabilities allow denial of service through unbounded resource consumption or malformed input handling such as unbounded brace range expansion, catastrophic backtracking in glob patterns, WebSocket decompression issues, HTTP request smuggling, malformed HTTP/2 frames, and crafted HTTP headers. The advisory references Red Hat's errata RHSA-2026:7080 and provides updated packages to address these issues.
Potential Impact
The vulnerabilities collectively enable denial of service conditions in Node.js environments by exploiting unbounded resource consumption, malformed input handling, and HTTP request smuggling. This can lead to application crashes or service unavailability. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:7080 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:7080
- Cve Count
- 9
- Additional Cves
- ["CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-21710","CVE-2026-25547","CVE-2026-26996","CVE-2026-27135","CVE-2026-27904"]
Threat ID: 6a160983e29bf47b5064fee6
Added to database: 05/26/2026, 20:58:43 UTC
Last enriched: 08/10/2026, 20:30:10 UTC
Last updated: 09/13/2026, 00:47:07 UTC
Views: 120
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.