This Red Hat security advisory (RHSA-2026:48305) updates Red Hat Hardened Images RPMs, particularly Node.js 22 packages, to address several vulnerabilities including CVE-2026-58043. The CVE-2026-58043 vulnerability is a permission model enforcement flaw in Node.js that allows an attacker with limited filesystem privileges to bypass access controls and perform unauthorized read/write operations on files and directories outside their authorized access. The flaw is due to incorrect authorization order before path parsing and canonicalization (CWE-551). Red Hat provides updated RPMs for nodejs22 and related components to remediate these issues. The advisory does not explicitly list affected versions but provides the updated package versions. No known exploits in the wild have been reported. Red Hat rates the severity as high and provides guidance for applying the update via their images.redhat.com portal.

An attacker with limited filesystem access can exploit the permission model flaw in Node.js to gain unauthorized read and write access to files and directories outside their permitted scope. This can lead to unauthorized information disclosure and data modification. The impact is significant as it compromises the integrity and confidentiality of the system's filesystem access controls. No availability impact is noted. No known active exploitation has been reported.

Red Hat has released updated RPM packages for Node.js 22 and related components as part of the Red Hat Hardened Images update (version 22.23.2-2.3.hum1 and related). Users should apply these updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://images.redhat.com/. No alternative mitigations are specified. Since this is an official Red Hat advisory with updated packages, applying the provided fixes is the recommended remediation.