This Red Hat security advisory addresses nine denial of service vulnerabilities affecting Node.js 22 and related components such as brace-expansion, minimatch, undici, and nghttp2. The vulnerabilities include unbounded brace range expansion (CVE-2026-25547), denial of service via crafted glob patterns (CVE-2026-26996, CVE-2026-27904), unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526), HTTP request smuggling and denial of service due to duplicate Content-Length headers (CVE-2026-1525), denial of service via crafted WebSocket frames (CVE-2026-1528), malformed HTTP/2 frames after session termination (CVE-2026-27135), and denial of service via crafted HTTP __proto__ headers (CVE-2026-21710). These issues can cause service disruption by exhausting resources or causing unexpected behavior in network communications. The advisory provides updated packages for Red Hat Enterprise Linux 8 to mitigate these vulnerabilities.

Successful exploitation of these vulnerabilities can lead to denial of service conditions, potentially causing Node.js applications or services to become unresponsive or crash. The issues affect various components handling network requests, WebSocket frames, HTTP/2 frames, and pattern matching, which may be exploited by specially crafted inputs to exhaust memory or processing resources. There is no indication of remote code execution or data disclosure in this advisory. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated nodejs:22 module packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:7123 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an on-premises product, patching is required by the user or administrator. No alternative mitigations or workarounds are specified in the advisory.