The advisory covers a set of 15 security vulnerabilities in Node.js 24 and related components, including undici and ip-address libraries. These issues include cross-site scripting (CVE-2026-42338), denial of service via unbounded memory growth and HTTP/2 ORIGIN frames (CVE-2026-12151, CVE-2026-48619), information disclosure due to improper cache-control and proxy tunnel error handling (CVE-2026-9678, CVE-2026-48615), response queue poisoning on reused keep-alive sockets (CVE-2026-6733), weakening of cookie SameSite policy (CVE-2026-11525), man-in-the-middle attacks via ignored TLS options with SOCKS5 proxy (CVE-2026-9697), certification validation bypass and trust-policy bypass due to hostname matching inconsistencies (CVE-2026-48934, CVE-2026-48928), unauthorized file metadata modification (CVE-2026-48935), and authentication bypass related to TLS hostname handling (CVE-2026-48618). The update rebases nodejs24 to the latest Node.js 24 release, incorporating fixes for these vulnerabilities. The advisory applies to Red Hat Enterprise Linux 10 and its variants.

The vulnerabilities collectively allow attackers to perform cross-site scripting, denial of service, information disclosure, man-in-the-middle attacks, authentication bypass, and unauthorized file metadata modification. These issues could compromise the confidentiality, integrity, and availability of applications using Node.js 24 on affected Red Hat Enterprise Linux systems. The impact ranges from incorrect response delivery and proxy credential exposure to TLS certificate validation bypass and weakening of security policies such as SameSite cookies.

Red Hat has released an updated nodejs24 package rebased to the latest Node.js 24 release that addresses all listed vulnerabilities. Users should apply this update promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's official advisory at https://access.redhat.com/articles/11258. No additional mitigations are indicated as the update provides an official fix.