The advisory covers a set of 13 security vulnerabilities in Node.js 22, fixed in the latest Red Hat Enterprise Linux 9.8 update. These include CVE-2026-42338 (XSS via improper HTML escaping), CVE-2026-12151 (DoS via unbounded memory growth in WebSocket frames), CVE-2026-9678 (information disclosure from cache-control header parsing), CVE-2026-6733 (response queue poisoning on reused keep-alive sockets), CVE-2026-11525 (weakening of cookie SameSite policy), CVE-2026-48619 (DoS via unlimited HTTP/2 ORIGIN frames), CVE-2026-48930 (silent authority rebinding due to embedded-nul hostnames in TLS), CVE-2026-48935 (unauthorized file metadata modification), CVE-2026-48933 (DoS via large input to subtle.encrypt()), CVE-2026-48934 (certification validation bypass in TLS host verification), CVE-2026-48928 (trust-policy bypass due to hostname matching inconsistency), CVE-2026-48615 (information disclosure of proxy credentials), and CVE-2026-48618 (authentication bypass due to TLS hostname handling and unicode dot separator mismatch). The update rebases Node.js 22 to the latest upstream release, addressing these issues comprehensively.

The vulnerabilities collectively allow attackers to perform cross-site scripting, denial of service attacks, information disclosure, authentication bypass, trust-policy bypass, and unauthorized file metadata modification. These issues can compromise application security, data confidentiality, and integrity in environments running affected Node.js versions. The advisory rates the impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released an updated Node.js 22 package as part of Red Hat Enterprise Linux 9.8 that includes fixes for all listed vulnerabilities. Users should apply this update promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.