The advisory covers five distinct security vulnerabilities affecting Node.js 22 on Red Hat Enterprise Linux 10.0 EUS. CVE-2026-42338 involves cross-site scripting due to improper HTML escaping in the ip-address package. CVE-2026-12151 is a denial of service caused by unbounded memory growth via WebSocket frames in the undici package. CVE-2026-48933 is a denial of service vulnerability in Node.js WebCrypto when processing large inputs to subtle.encrypt(). CVE-2026-48615 allows information disclosure of proxy credentials through proxy tunnel error handling. CVE-2026-48618 enables authentication bypass due to TLS hostname handling and unicode dot separator mismatches. Red Hat has issued updated packages to fix these vulnerabilities in nodejs22 version 22.23.1-2.el10_0 across multiple architectures including x86_64, s390x, ppc64le, and aarch64.

These vulnerabilities collectively impact the security of Node.js applications running on affected Red Hat Enterprise Linux 10.0 systems. They can lead to cross-site scripting attacks, denial of service conditions, unauthorized disclosure of sensitive proxy credentials, and authentication bypasses. Such impacts can compromise application integrity, availability, and confidentiality if exploited.

Red Hat has released updated nodejs22 packages (version 22.23.1-2.el10_0) that address all listed vulnerabilities. Users running affected versions on Red Hat Enterprise Linux 10.0 Extended Update Support should apply these updates promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.