This Red Hat security advisory (RHSA-2026:48305) updates several Node.js 22 RPM packages within Red Hat Hardened Images to address multiple vulnerabilities, including CVE-2026-58043. The key vulnerability CVE-2026-58043 involves a flaw in the Node.js Permission Model that allows an attacker to bypass filesystem permission restrictions, leading to unauthorized read or write access and potential privilege escalation within the application's sandbox. The advisory lists updated package versions for architectures aarch64 and x86_64. Red Hat scores the severity as high and notes that the vulnerability requires local access with low privileges but has a high impact on confidentiality and integrity. The vendor recommends disabling the Permission Model by not using the --permission flag to mitigate this issue if patching is not immediately possible. The advisory does not explicitly state that a patch is available but provides updated RPM versions, implying fixes are included in these updates.

The vulnerabilities addressed in this advisory, particularly CVE-2026-58043, allow attackers with initial access to bypass Node.js Permission Model restrictions, enabling unauthorized filesystem read and write operations. This can lead to privilege escalation within the sandboxed environment of Node.js applications, compromising confidentiality and integrity of data. The impact is rated high by Red Hat, indicating significant risk if exploited. There are no known exploits in the wild at the time of this advisory.

Red Hat provides updated RPM packages for Node.js 22 as part of this advisory, which include fixes for the reported vulnerabilities. Users should apply these updates to remediate the issues. For CVE-2026-58043 specifically, Red Hat recommends avoiding the use of the Node.js Permission Model by not enabling the --permission flag when starting Node.js applications, as this disables the vulnerable enforcement mechanism. This mitigation may remove an intended security layer if the application relies on the Permission Model for sandboxing. No other specific mitigations are detailed in the advisory.