This Red Hat security advisory (RHSA-2026:30172) updates Red Hat Hardened Images RPMs, specifically Node.js 26 packages, to address three CVEs: CVE-2026-48615, CVE-2026-48618, and CVE-2026-48933. The most detailed vulnerability, CVE-2026-48618, is an authentication bypass in Node.js caused by a mismatch in handling TLS hostnames and unicode dot separators, leading to a wildcard-depth authentication bypass. This flaw affects Node.js versions 22, 24, and 26 as distributed by Red Hat. The advisory notes that no suitable mitigation or patch currently meets Red Hat's standards for deployment and stability. The update includes new RPM packages for nodejs26 and related components. Red Hat scores this vulnerability as high severity, reflecting the potential for unauthorized access and confidentiality impact. No CVSS score is provided by Red Hat, but the issue is rated important due to its impact on TLS authentication.

The primary impact is an authentication bypass vulnerability in Node.js TLS hostname verification, allowing attackers to circumvent intended security boundaries. This can lead to unauthorized access and compromise of sensitive information in applications using affected Node.js versions for TLS connections. The vulnerability affects confidentiality but does not impact integrity or availability. There are no known exploits in the wild at this time. The issue affects Red Hat Hardened Images containing Node.js versions 22, 24, and 26.

Currently, Red Hat states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should apply the updated RPM packages provided in the advisory once they become available and monitor Red Hat's official channels for further updates or fixes. Customers with a Technical Account Manager (TAM) can consult directly for guidance. Until a fix is released, consider limiting exposure of affected Node.js services and applying any recommended configuration changes from Red Hat if provided.