This Red Hat security advisory addresses multiple denial of service vulnerabilities and an HTTP request smuggling vulnerability in Node.js 22 and its dependencies (brace-expansion, minimatch, undici, nghttp2). The issues include unbounded resource consumption via crafted inputs such as glob patterns, WebSocket frames, HTTP headers, and malformed HTTP/2 frames. The advisory covers nine CVEs, including CVE-2026-1525 (HTTP request smuggling and denial of service due to duplicate Content-Length headers in undici), CVE-2026-1526, CVE-2026-1528, CVE-2026-2229, CVE-2026-21710, CVE-2026-25547, CVE-2026-26996, CVE-2026-27135, and CVE-2026-27904. These vulnerabilities can cause denial of service conditions or enable HTTP request smuggling attacks when exploited. The advisory is for Red Hat Enterprise Linux 10 nodejs22 packages and related architectures.

Exploitation of these vulnerabilities can lead to denial of service conditions in Node.js applications by causing unbounded resource consumption (memory or CPU) or crashing the application through malformed inputs. Additionally, one vulnerability (CVE-2026-1525) allows HTTP request smuggling, which can lead to request misrouting or bypassing security controls. These issues affect network-facing Node.js applications and services that process crafted HTTP, WebSocket, or glob pattern inputs, potentially disrupting service availability.

Red Hat has released an updated nodejs22 package for Red Hat Enterprise Linux 10 that addresses these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:7080 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified or required beyond applying the official update.