The advisory covers a set of 13 security vulnerabilities in Node.js 22 on Red Hat Enterprise Linux 10. These include CVE-2026-6733 (response queue poisoning on reused keep-alive sockets), CVE-2026-9678 (information disclosure via improper cache-control header parsing), CVE-2026-11525 (weakening of cookie SameSite policy), CVE-2026-12151 (denial of service via unbounded memory growth in WebSocket frames), CVE-2026-42338 (cross-site scripting via improper HTML escaping), CVE-2026-48615 (information disclosure of proxy credentials), CVE-2026-48618 (authentication bypass due to TLS hostname handling), CVE-2026-48619 (denial of service via unlimited HTTP/2 ORIGIN frames), CVE-2026-48928 (trust-policy bypass due to hostname matching inconsistency), CVE-2026-48930 (silent authority rebinding due to embedded-nul hostnames in TLS), CVE-2026-48933 (denial of service via large input to subtle.encrypt()), CVE-2026-48934 (certification validation bypass in TLS host verification), and CVE-2026-48935 (unauthorized file metadata modification). The update rebases nodejs22 to the latest upstream Node.js 22 release, addressing these issues. Red Hat rates the security impact as Important and provides updated packages for Red Hat Enterprise Linux 10 on multiple architectures.

The vulnerabilities collectively allow for cross-site scripting, denial of service conditions, information disclosure, authentication bypass, trust-policy bypass, and unauthorized file metadata modification in Node.js applications running on affected Red Hat Enterprise Linux 10 systems. These issues could lead to incorrect response delivery, exposure of sensitive proxy credentials, bypass of TLS hostname verification, weakening of cookie security policies, and potential disruption or compromise of Node.js-based network applications. The advisory rates the overall impact as Important, indicating significant security concerns that could affect confidentiality, integrity, and availability of affected systems.

Red Hat has released an updated nodejs22 package rebased to the latest Node.js 22 release that addresses all listed vulnerabilities. Users of Red Hat Enterprise Linux 10 should apply this update promptly to remediate these security issues. Detailed update instructions are available in the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update. There are no indications that these vulnerabilities are currently exploited in the wild.