This Red Hat security advisory addresses nine denial of service vulnerabilities in Node.js 22 and its dependencies. The issues include unbounded brace range expansion (CVE-2026-25547), denial of service via crafted glob patterns and catastrophic backtracking in minimatch (CVE-2026-26996, CVE-2026-27904), multiple denial of service flaws in undici related to WebSocket permessage-deflate decompression, invalid extension parameters, duplicate Content-Length headers causing HTTP request smuggling (CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229), denial of service via malformed HTTP/2 frames in nghttp2 (CVE-2026-27135), and denial of service due to crafted HTTP __proto__ header in Node.js core (CVE-2026-21710). These vulnerabilities can cause service disruption but no known exploits in the wild are reported. The advisory applies to Node.js 22 versions from 22.0.0 up to and including 22.22.2 as packaged for Red Hat Enterprise Linux 9.6 EUS.

The vulnerabilities collectively enable denial of service conditions in Node.js applications by exploiting unbounded resource consumption, request smuggling, and malformed input handling. This can lead to application crashes or unavailability, impacting the reliability of services built on Node.js 22. There is no indication of remote code execution or data breach from these issues. No known active exploitation has been reported.

Red Hat has released an important security update for Node.js 22 on Red Hat Enterprise Linux 9.6 Extended Update Support that addresses all listed vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:7983 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.