This Red Hat security advisory (RHSA-2026:2864) addresses multiple vulnerabilities affecting Red Hat Hardened Images RPMs, particularly the nodejs24 package set on aarch64 and x86_64 architectures. The update includes new versions of nodejs24, nodejs24-bin, nodejs24-devel, nodejs24-libs, nodejs24-npm, and the v8 engine. The advisory covers several CVEs (CVE-2025-55130, CVE-2025-55131, CVE-2025-59465, CVE-2025-59466, CVE-2026-21637) and associated CWEs such as CWE-281, CWE-497, CWE-770, CWE-248, CWE-279, and CWE-328. No CVSS scores or detailed exploit information are provided. The update is intended to fix bugs and enhance security in the affected packages.

The vulnerabilities addressed are considered high severity and affect Red Hat Hardened Images and nodejs24 packages on supported architectures. The impact involves potential security weaknesses related to authentication, authorization, resource management, and cryptographic issues as indicated by the associated CWEs. No known exploits in the wild have been reported, but the presence of multiple CVEs suggests a significant risk if unpatched.

Red Hat has released updated RPM packages for nodejs24 and related components as part of this advisory. Users of Red Hat Hardened Images and nodejs24 packages should apply these updates promptly to mitigate the vulnerabilities. Since this is an official Red Hat security advisory, the fix is available through the vendor's standard update channels. No additional mitigation steps are indicated beyond applying the provided updates.