The Red Hat security advisory RHSA-2026:30172 reports updates to Red Hat Hardened Images RPMs, including Node.js 26 packages, to address multiple vulnerabilities including CVE-2026-48615, CVE-2026-48618, and CVE-2026-48933. The most detailed vulnerability, CVE-2026-48618, involves a TLS wildcard-depth authentication bypass caused by a mismatch in how Node.js handles TLS hostnames and unicode dot separators during authentication. This flaw allows attackers to circumvent intended security boundaries, potentially leading to unauthorized access and confidentiality breaches in applications using Node.js for TLS connections. The advisory notes that mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use and deployment. The affected Node.js versions include 22, 24, and 26 as shipped in Red Hat products. The advisory does not explicitly confirm that a patch is available, and no patch links are provided. Red Hat remains the authoritative source for updates and remediation guidance.

The primary impact is an authentication bypass in Node.js TLS hostname verification, which can allow attackers to circumvent security boundaries and gain unauthorized access to sensitive information. This affects confidentiality but does not impact integrity or availability. The flaw affects Node.js versions 22, 24, and 26 as distributed by Red Hat in their Hardened Images. The severity is high due to the potential for unauthorized access and confidentiality compromise.

The Red Hat advisory states that mitigation options are either not available or do not meet Red Hat's criteria for ease of use, deployment, applicability, or stability. No explicit patch or fix is currently confirmed in the advisory. Users should monitor Red Hat's official errata and security advisory pages for updates and apply updates once they become available. Customers with Red Hat Technical Account Managers (TAM) can consult them for direct guidance. Until a fix is released, no specific mitigation is recommended by Red Hat.