The advisory covers nine distinct denial of service vulnerabilities affecting Node.js 22 and its dependencies, including brace-expansion (CVE-2026-25547), minimatch (CVE-2026-26996, CVE-2026-27904), undici (CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229), nghttp2 (CVE-2026-27135), and Node.js core (CVE-2026-21710). These vulnerabilities involve unbounded resource consumption, HTTP request smuggling, and malformed protocol frames that can lead to denial of service. The advisory references Red Hat Enterprise Linux 8 packages updated to Node.js 22.22.2 to address these issues. No CVSS scores are provided in the advisory, but the impact is rated as important by Red Hat.

Successful exploitation of these vulnerabilities could result in denial of service conditions on affected systems running Node.js 22 on Red Hat Enterprise Linux 8. This could disrupt network applications by exhausting memory or CPU resources or by exploiting protocol handling flaws such as HTTP request smuggling. There is no indication of remote code execution or data compromise in this advisory. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for the nodejs:22 module in Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:7123 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. Since this is an official Red Hat security update, applying the vendor-provided patch is the recommended mitigation. No additional vendor mitigation guidance is provided.