This Red Hat security advisory addresses nine denial of service vulnerabilities affecting Node.js and related libraries in the nodejs:22 module. The vulnerabilities include unbounded brace range expansion (CVE-2026-25547), denial of service via crafted glob patterns and catastrophic backtracking in minimatch (CVE-2026-26996, CVE-2026-27904), unbounded memory consumption and invalid parameters in undici's WebSocket permessage-deflate decompression (CVE-2026-1526, CVE-2026-2229), HTTP request smuggling and denial of service due to duplicate Content-Length headers in undici (CVE-2026-1525), denial of service via crafted WebSocket frames (CVE-2026-1528), denial of service via malformed HTTP/2 frames in nghttp2 (CVE-2026-27135), and denial of service due to crafted HTTP __proto__ headers in Node.js (CVE-2026-21710). These issues can cause service disruption by exhausting resources or causing crashes. Red Hat has released updated packages for Red Hat Enterprise Linux 9 to mitigate these vulnerabilities.

The vulnerabilities can lead to denial of service conditions in applications using the affected Node.js module and its dependencies. Attackers may exploit these flaws by sending specially crafted inputs such as malformed HTTP headers, WebSocket frames, or glob patterns, resulting in unbounded memory consumption, catastrophic backtracking, or request smuggling. This can cause application crashes or resource exhaustion, impacting availability.

Red Hat has released an updated nodejs:22 module for Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:7302 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.