This Red Hat security advisory (RHSA-2026:28727) reports on multiple vulnerabilities affecting Red Hat Hardened Images RPMs, including Node.js components. Among the CVEs addressed is CVE-2026-48618, a flaw in Node.js that causes a TLS wildcard-depth authentication bypass due to a mismatch in handling hostnames and unicode dot separators during TLS authentication. This flaw can allow attackers to bypass intended security boundaries, leading to unauthorized access and confidentiality breaches in applications using Node.js for TLS connections. The advisory lists updated RPM packages for nodejs22 and related components but does not confirm that these updates fix all reported CVEs. Red Hat notes that no suitable mitigation or fix currently meets their criteria for ease of use, applicability, or stability. The vulnerability affects Node.js versions 22, 24, and 26 as shipped by Red Hat. The advisory includes references to CWE-209 (Information Exposure), CWE-289 (Authentication Bypass), and CWE-770 (Allocation of Resources Without Limits or Throttling). No CVSS score is provided by Red Hat for these vulnerabilities.

The primary impact is an authentication bypass vulnerability in Node.js TLS hostname verification, which can allow attackers to circumvent security boundaries and gain unauthorized access to sensitive information. This affects confidentiality but not integrity or availability. The advisory indicates a high severity level due to the potential for unauthorized access and compromise of sensitive data in affected applications. Other vulnerabilities referenced may involve information exposure and resource allocation issues, but specific impacts are not detailed. No known exploits in the wild have been reported.

Currently, no official fix or patch is available for the TLS wildcard-depth authentication bypass vulnerability that meets Red Hat's criteria for deployment. Red Hat advises monitoring their advisory pages and applying updates when they become available. Users should refer to the Red Hat Hardened Images update instructions at https://images.redhat.com/ for applying the latest RPM updates. Customers with a Technical Account Manager (TAM) or RHEL Security Select Add-on can consult directly with Red Hat for tailored guidance. No alternative mitigations are provided or recommended by Red Hat at this time.