A flaw in Node.js WebCrypto's subtle.encrypt() function allows a remote attacker to cause a denial of service by crashing the Node.js process when providing an input size that is a multiple of 2 GiB. This integer overflow and resource allocation issue (CWE-190, CWE-770) affects all supported Node.js release lines: 22, 24, and 26. The vulnerability has been assigned CVE-2026-48933 with a CVSS v3 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Red Hat has issued security advisories and released updated Node.js packages (e.g., nodejs22-22.23.1) to address this issue in their supported distributions. No alternative mitigations are currently available or meet Red Hat's criteria for deployment and stability.

Exploitation of this vulnerability results in a denial of service by crashing the Node.js process, leading to potential service unavailability. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction by providing a crafted input to subtle.encrypt(). This can disrupt applications relying on Node.js WebCrypto for encryption operations.

A security update fixing this vulnerability is available from Red Hat for affected Node.js packages (e.g., nodejs22-22.23.1 and later). Users should apply these official patches to remediate the issue. Currently, no other mitigations or workarounds meet Red Hat's criteria for ease of use, applicability, and stability. Therefore, applying the vendor-provided update is the recommended remediation.