This advisory covers several security flaws in Node.js 22 and its dependencies as distributed by Red Hat. Notable vulnerabilities include CVE-2026-12151, a denial of service in the undici HTTP client due to unbounded memory growth via WebSocket frames; CVE-2026-42338, a cross-site scripting vulnerability in the ip-address library caused by improper HTML escaping of untrusted input; CVE-2026-48933, a denial of service in Node.js WebCrypto via large input to subtle.encrypt(); CVE-2026-48615, information disclosure of proxy credentials through proxy tunnel error handling; and CVE-2026-48618, an authentication bypass due to TLS hostname handling and unicode dot separator mismatch. Additional denial of service vulnerabilities exist in brace-expansion and node-tar components. Red Hat has issued updated packages for multiple architectures and versions of Red Hat Enterprise Linux to address these issues.

The vulnerabilities collectively allow attackers to cause denial of service conditions, execute cross-site scripting attacks, disclose sensitive proxy credentials, and bypass authentication mechanisms in affected Node.js environments. These issues could impact the security and availability of applications relying on Node.js 22 on Red Hat Enterprise Linux 9.6 and 10.0 Extended Update Support. No known exploits in the wild have been reported at this time.

Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 9.6 and 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.