This Red Hat security advisory (RHSA-2026:29012) reports on vulnerabilities affecting Red Hat Hardened Images RPMs, including Node.js versions 22, 24, and 26. The most significant vulnerability, CVE-2026-48618, is a TLS wildcard-depth authentication bypass caused by a mismatch in handling hostnames and unicode dot separators during TLS authentication. This flaw can allow attackers to bypass security boundaries and gain unauthorized access, impacting confidentiality. The advisory also references CVE-2026-48615 and CVE-2026-48933 but provides no detailed descriptions for these. The update includes new RPM versions for nodejs24 and related packages. Red Hat currently does not provide a fix or effective mitigation for the TLS authentication bypass that meets their standards for ease of deployment and stability. The advisory emphasizes that Red Hat remains the authoritative source for impact and scoring, noting differences from other CVSS scores. No known exploits are reported in the wild.

The TLS wildcard-depth authentication bypass (CVE-2026-48618) can allow attackers to circumvent intended security boundaries in applications using Node.js for TLS connections, potentially leading to unauthorized access and compromise of sensitive information. The impact is rated as high severity by Red Hat. The other CVEs mentioned (CVE-2026-48615 and CVE-2026-48933) are included in the advisory but lack detailed impact descriptions. There are no known exploits in the wild at this time.

Currently, no official fix or patch is available for the TLS authentication bypass vulnerability that meets Red Hat's criteria for deployment and stability. Users are advised to monitor Red Hat's advisories for updates and consider upgrading to supported product versions once fixes are released. Red Hat suggests consulting with Technical Account Managers for tailored guidance. No alternative mitigations meeting Red Hat's standards are provided at this time.