An integer overflow flaw (CWE-190) in the Node.js WebCrypto subtle.encrypt() API can cause a denial of service by crashing the Node.js process when the input size is a multiple of 2 GiB. This affects all supported Node.js release lines (22, 24, and 26). The vulnerability is tracked as CVE-2026-48933 and has a CVSS 3.0 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network exploitable with low attack complexity and no privileges or user interaction required, impacting availability only. Red Hat has released security updates for their Node.js packages to address this issue. The vendor advisory URLs from Red Hat provide details and fixes for affected Red Hat Enterprise Linux versions. There is no indication of known exploits in the wild.

Successful exploitation of this vulnerability results in a denial of service condition by crashing the Node.js process. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction, making it a significant availability risk for applications relying on Node.js WebCrypto subtle.encrypt() with large inputs.

Red Hat has released security updates for their Node.js packages that fix this vulnerability. Users of affected Node.js versions (22, 24, and 26) on Red Hat Enterprise Linux should apply the relevant security updates as described in the Red Hat advisories (e.g., RHSA-2026:39246). Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official updates.