This Red Hat security advisory (RHSA-2026:7983) addresses nine denial of service vulnerabilities affecting the nodejs:22 module on Red Hat Enterprise Linux 9.6 Extended Update Support. The vulnerabilities include unbounded brace range expansion in brace-expansion (CVE-2026-25547), denial of service via crafted glob patterns and catastrophic backtracking in minimatch (CVE-2026-26996, CVE-2026-27904), multiple denial of service issues in undici related to WebSocket permessage-deflate decompression, invalid extension parameters, duplicate Content-Length headers causing HTTP request smuggling (CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229), denial of service from malformed HTTP/2 frames in nghttp2 (CVE-2026-27135), and denial of service from crafted HTTP __proto__ headers in Node.js core (CVE-2026-21710). Red Hat has released an update for nodejs:22 (version 22.22.2-1.module+el9.6.0+24196+39669d4e) that fixes these issues. The advisory references multiple bugzilla entries and CVE pages for detailed information. No CVSS scores are provided in the advisory. The update is classified as important by Red Hat Product Security.

The vulnerabilities collectively enable denial of service attacks against Node.js applications running on affected Red Hat Enterprise Linux 9.6 systems. Attackers can cause unbounded resource consumption, HTTP request smuggling, and application crashes by sending specially crafted inputs such as glob patterns, WebSocket frames, HTTP/2 frames, or HTTP headers. This can disrupt availability of network applications built on Node.js, potentially impacting services relying on these platforms.

Red Hat has released an official security update for the nodejs:22 module on Red Hat Enterprise Linux 9.6 Extended Update Support that addresses all listed vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:7983 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed as an official fix available via Red Hat's update channels.