Red Hat Product Security has released an advisory (RHSA-2026:37532) for a security vulnerability identified as CVE-2026-59869 affecting nodejs26 packages within Red Hat Hardened Images RPMs. The update includes multiple RPMs such as nodejs26, nodejs26-bin, nodejs26-devel, nodejs26-libs, and related components for aarch64 and x86_64 architectures. The vulnerability is linked to CWE-606, which generally relates to unchecked input for resource consumption. The advisory references updated RPM versions (e.g., nodejs26-26.4.0-1.4.hum1) but does not explicitly state which prior versions are vulnerable or provide a CVSS score. No known exploits are reported. The advisory directs users to apply the update via Red Hat's image repository and official channels.

The vulnerability affects nodejs26 packages in Red Hat Hardened Images, potentially allowing resource consumption issues due to CWE-606. The severity is assessed as high by Red Hat. No known exploits in the wild have been reported, indicating limited or no active exploitation at this time. The impact is limited to affected Red Hat Hardened Images RPMs containing nodejs26 components on aarch64 and x86_64 architectures.

Red Hat has issued updated RPM packages for nodejs26 as part of the Hardened Images security update. Users should apply these updates to remediate CVE-2026-59869. The advisory does not mention any temporary workarounds or alternative mitigations. Since this is not a cloud service, remediation requires manual update of the affected RPMs. Patch status is not explicitly confirmed as 'fixed in' a particular version, but the advisory provides updated package versions to apply. Users should follow Red Hat's official update instructions at https://images.redhat.com/ and consult the advisory at https://access.redhat.com/errata/RHSA-2026:37532 for detailed guidance.