This advisory covers multiple denial of service vulnerabilities in Node.js 22 and its dependencies on Red Hat Enterprise Linux 9. The issues include CVE-2026-25547 (brace-expansion unbounded brace range expansion), CVE-2026-26996 and CVE-2026-27904 (minimatch denial of service via crafted glob patterns), CVE-2026-1526, CVE-2026-2229, CVE-2026-1525, and CVE-2026-1528 (undici denial of service and HTTP request smuggling via WebSocket decompression and duplicate Content-Length headers), CVE-2026-27135 (nghttp2 denial of service via malformed HTTP/2 frames), and CVE-2026-21710 (Node.js denial of service via crafted HTTP __proto__ header). Red Hat has released updated Node.js 22 packages that address these vulnerabilities. The advisory references Red Hat Enterprise Linux 9 and related architectures. No CVSS scores are provided in the advisory, but the impact is denial of service. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could allow an attacker to cause denial of service conditions in Node.js applications by triggering unbounded resource consumption, HTTP request smuggling, or malformed protocol frames. This could lead to application crashes or degraded service availability. There is no indication of remote code execution or data breach impacts in this advisory. No known active exploitation has been reported.

Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update to Node.js 22 to remediate these issues. Refer to the Red Hat advisory RHSA-2026:7302 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. No additional mitigation is indicated by the vendor.