The advisory covers 15 distinct vulnerabilities affecting Node.js 24 and its dependencies, including undici and ip-address libraries. Vulnerabilities include cross-site scripting via improper HTML escaping (CVE-2026-42338), denial of service from unbounded memory growth via WebSocket frames (CVE-2026-12151), information disclosure due to improper cache-control header parsing (CVE-2026-9678), response queue poisoning on reused keep-alive sockets (CVE-2026-6733), weakening of cookie SameSite policy (CVE-2026-11525), man-in-the-middle attacks via ignored TLS options with SOCKS5 proxy (CVE-2026-9697), and multiple TLS-related authentication and trust-policy bypasses (e.g., CVE-2026-48934, CVE-2026-48928). The update rebases Node.js 24 to the latest upstream release to address these issues. The advisory applies to Red Hat Enterprise Linux 9 and its variants. No explicit affected version ranges are provided, but the update is for the nodejs:24 module. No known exploits in the wild are reported.

The vulnerabilities collectively allow attackers to perform cross-site scripting, denial of service, information disclosure, authentication bypass, and man-in-the-middle attacks. These issues can lead to unauthorized access, data leakage, service disruption, and incorrect response delivery in applications using affected Node.js versions and libraries. The severity is rated high by Red Hat Product Security.

Red Hat has released an updated nodejs:24 module rebased to the latest Node.js 24 release that addresses all listed vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:35891 to remediate these issues. No additional mitigations or workarounds are specified. Patch status is confirmed as an official fix available from Red Hat.