Nodejs: A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB. (CVE-2026-48933)

CVE-2026-48933 describes a flaw in the Node.js WebCrypto implementation where invoking subtle.encrypt() with input sizes that are multiples of 2 GiB causes the Node.js process to crash. This denial-of-service vulnerability affects all supported Node.js release lines 22, 24, and 26 in certain versions, as well as several Ubuntu package versions. Red Hat has published multiple security advisories providing patched RPM packages for Red Hat Hardened Images and related Node.js builds to remediate this issue.

The vulnerability results in a denial-of-service condition by crashing the Node.js process when processing specific input sizes in subtle.encrypt(). There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Official patches are available from Red Hat as detailed in their security advisories (e.g., RHSA-2026:28727, RHSA-2026:29012). Users should apply these updates to affected Node.js packages to remediate the vulnerability. No additional mitigation steps are indicated by the vendor.