Red Hat issued a security advisory (RHSA-2026:28727) for Red Hat Hardened Images RPMs that includes updates to Node.js 22 packages. Among the addressed issues is CVE-2026-48618, a flaw in Node.js that causes a TLS wildcard-depth authentication bypass due to a mismatch in handling hostnames and unicode dot separators during TLS authentication. This vulnerability can allow attackers to bypass intended security boundaries, leading to unauthorized access and confidentiality impact. The issue affects Node.js versions 22, 24, and 26 as shipped in Red Hat products. Red Hat currently does not provide a mitigation that meets its criteria for ease of use, applicability, or stability. The advisory also references additional CVEs (CVE-2026-48615 and CVE-2026-48933) included in the update. No known exploits are reported in the wild. The update packages include nodejs22 and related components for aarch64 and x86_64 architectures. Red Hat remains the authoritative source for impact and remediation status.

The primary impact is an authentication bypass vulnerability in Node.js TLS hostname verification, which can allow attackers to circumvent security boundaries and gain unauthorized access to sensitive information. This impacts confidentiality but not integrity or availability. The vulnerability affects Node.js versions 22, 24, and 26 as shipped by Red Hat. No known active exploitation has been reported. The issue could compromise applications relying on Node.js for TLS connections.

Red Hat currently does not offer an official fix or mitigation for the TLS wildcard-depth authentication bypass that meets its criteria for deployment and stability. Users are advised to apply the available RPM updates for Red Hat Hardened Images to address other included fixes and enhancements. For the authentication bypass vulnerability, monitor Red Hat advisories for future updates. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance. No temporary mitigations are currently recommended by Red Hat.