The Red Hat security advisory RHSA-2026:48273 details updates to Red Hat Hardened Images RPMs, including Node.js 26 packages, to fix multiple vulnerabilities such as CVE-2026-56850 and CVE-2026-58043. CVE-2026-58043 is a flaw in Node.js's permission model enforcement when the --permission flag is active, allowing attackers with limited file system access to bypass authorization controls and access unauthorized files or directories. The advisory lists updated RPM versions for nodejs26 and related packages. Red Hat has released these updates to address the vulnerabilities, but no explicit patch links or detailed remediation instructions are provided beyond the advisory references. No exploits are known to be active in the wild.

The primary impact is unauthorized file system access due to improper enforcement of permission controls in Node.js, potentially leading to unauthorized information disclosure and data modification. The vulnerabilities affect Red Hat Hardened Images and Node.js packages on aarch64 and x86_64 architectures. The severity is assessed as medium (moderate), reflecting the potential for privilege escalation or unauthorized access but with conditions such as requiring local access and high attack complexity.

Red Hat has released updated RPM packages for Node.js 26 and related components as part of the Red Hat Hardened Images update. Users should apply these official updates to remediate the vulnerabilities. No alternative mitigations or workarounds are explicitly stated in the advisory. Patch status is confirmed by the availability of updated RPMs in the advisory. Users should follow Red Hat's official guidance at https://images.redhat.com/ and https://access.redhat.com/security/updates/classification/ for applying updates.