This Red Hat security advisory (RHSA-2026:7675) covers an important update to nodejs24 on Red Hat Enterprise Linux 10, addressing 18 distinct vulnerabilities. These include denial of service flaws in Node.js core, undici HTTP client library, nghttp2 HTTP/2 library, and related packages (brace-expansion, minimatch). Other issues fixed include HTTP header injection, request smuggling, information disclosure via filesystem and HMAC timing attacks, permission bypass allowing unauthorized file permission changes, and missing Unix Domain Socket permission checks enabling unauthorized inter-process communication. The update mitigates risks from crafted inputs causing resource exhaustion, memory leaks, and security bypasses. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat.

The vulnerabilities collectively impact Node.js 24 on Red Hat Enterprise Linux 10, potentially allowing attackers to cause denial of service conditions, leak sensitive information, perform unauthorized modifications to file permissions, and bypass inter-process communication restrictions. These issues could disrupt application availability and compromise security controls. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released an official security update for nodejs24 as detailed in advisory RHSA-2026:7675. Users should apply this update promptly to remediate the vulnerabilities. For instructions on applying the update, refer to https://access.redhat.com/articles/11258. Since this is an official fix, no additional mitigation steps are required beyond applying the update.