This Red Hat security advisory addresses several denial of service vulnerabilities in Node.js 22 and its dependencies. The vulnerabilities include denial of service via specially crafted glob patterns and catastrophic backtracking in minimatch (CVE-2026-26996, CVE-2026-27904), unbounded memory consumption and invalid parameters in undici's WebSocket permessage-deflate decompression (CVE-2026-1526, CVE-2026-2229), HTTP request smuggling and denial of service due to duplicate Content-Length headers in undici (CVE-2026-1525), denial of service via crafted WebSocket frames (CVE-2026-1528), denial of service via malformed HTTP/2 frames in nghttp2 (CVE-2026-27135), and denial of service due to crafted HTTP __proto__ headers in Node.js core (CVE-2026-21710). These vulnerabilities can lead to service disruption through resource exhaustion or protocol manipulation. The advisory covers Red Hat Enterprise Linux 10.0 Extended Update Support versions of nodejs22.

The vulnerabilities collectively allow an attacker to cause denial of service conditions on affected Node.js 22 installations by sending specially crafted inputs that trigger excessive resource consumption or protocol anomalies. This can disrupt network applications relying on Node.js, potentially causing service outages or degraded performance. No known exploits in the wild have been reported at this time.

Red Hat has released updated nodejs22 packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:7310 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation is indicated by the vendor advisory.