RHSA-2026:48305HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
July 29, 2026
Last Modified
September 6, 2026

🔗 CVE IDs covered (10)

CVE-2026-56846 →CVE-2026-56850 →CVE-2026-58039 →CVE-2026-58043 →CVE-2026-58044 →CVE-2026-58045 →CVE-2026-56847 →CVE-2026-58040 →CVE-2026-58041 →CVE-2026-58042 →

📋 Description

CVE-2026-56846 — nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks CVE-2026-56847 — nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions CVE-2026-56850 — nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw CVE-2026-58039 — nodejs: Information disclosure due to improper permission enforcement CVE-2026-58040 — nodejs: HTTPS Agent TLS session reuse skips hostname verification CVE-2026-58041 — nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator CVE-2026-58042 — nodejs: Node.js: Denial of Service via DNS responses with excessive A records CVE-2026-58043 — nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58044 — nodejs: Node.js: Request smuggling via HTTP client header truncation CVE-2026-58045 — nodejs: Node.js: Denial of Service vulnerability

🎯 Affected products5

  • Red Hat Hardened Images
  • nodejs22-main@aarch64 as a component of Red Hat Hardened Images
  • nodejs22-main@noarch as a component of Red Hat Hardened Images
  • nodejs22-main@src as a component of Red Hat Hardened Images
  • nodejs22-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption. Workaround: Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact. Workaround: To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes. Workaround: Applications using Node.js that leverage the experimental `node:sqlite` SQL tag store feature should avoid using `DatabaseSync#createTagStore()` and `StatementSyncIterator` to prevent unintended data modification. If this feature is not essential, refactoring the application to remove its usage will mitigate the vulnerability. Workaround: If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT. Workaround: Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.

🔗 References (14)