This Red Hat security advisory (RHSA-2026:9455) covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, specifically including nodejs20 and yarnpkg packages. The advisory addresses CVE-2026-2950 and multiple other CVEs related to these packages. The update includes new package versions such as nodejs20-20.20.2-1.hum1 and yarnpkg-1.22.22-18.1.hum1 for aarch64 and x86_64 architectures. The advisory does not provide a CVSS score or detailed vulnerability descriptions but classifies the update as high severity. The vendor advisory indicates that updated RPMs are available and should be applied to remediate the issues.

The vulnerabilities addressed by this advisory affect Red Hat Hardened Images RPMs including nodejs20 and yarnpkg packages on aarch64 and x86_64 architectures. The impact is considered high severity by Red Hat, implying significant security risks if unpatched. Specific impacts are not detailed in the advisory, but the presence of multiple CWEs suggests issues related to authentication, information exposure, and security bypasses. No known exploits in the wild have been reported at this time.

Red Hat has released updated RPM packages containing fixes and enhancements for the affected components. Users should apply the updates to nodejs20 and yarnpkg packages as provided by Red Hat Hardened Images to remediate the vulnerabilities. The advisory references updated package versions and repositories for obtaining the fixes. Since this is not a cloud service, remediation requires applying these updated RPMs. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.