{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs22:\n  * nodejs22-22.23.2-2.3.hum1 (aarch64, x86_64)\n  * nodejs22-bin-22.23.2-2.3.hum1 (noarch)\n  * nodejs22-devel-22.23.2-2.3.hum1 (aarch64, x86_64)\n  * nodejs22-docs-22.23.2-2.3.hum1 (noarch)\n  * nodejs22-full-i18n-22.23.2-2.3.hum1 (aarch64, x86_64)\n  * nodejs22-libs-22.23.2-2.3.hum1 (aarch64, x86_64)\n  * nodejs22-npm-10.9.8-1.22.23.2.2.3.hum1 (noarch)\n  * nodejs22-npm-bin-22.23.2-2.3.hum1 (noarch)\n  * v8-12.4-devel-12.4.254.21-1.22.23.2.2.3.hum1 (aarch64, x86_64)\n  * nodejs22-22.23.2-2.3.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:48305",
        "url": "https://access.redhat.com/errata/RHSA-2026:48305"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58043",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58043"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56847",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56847"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56850",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58040",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58039",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56846",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56846"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58044",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58044"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58042",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58042"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58041",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58041"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58045",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58045"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48305.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-17T16:25:53+00:00",
      "generator": {
        "date": "2026-08-17T16:25:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:48305",
      "initial_release_date": "2026-07-29T22:50:53+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T22:50:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-15T05:55:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-17T16:25:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-main@aarch64",
                "product": {
                  "name": "nodejs22-main@aarch64",
                  "product_id": "nodejs22-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.23.2-2.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-main@src",
                "product": {
                  "name": "nodejs22-main@src",
                  "product_id": "nodejs22-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.23.2-2.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-main@x86_64",
                "product": {
                  "name": "nodejs22-main@x86_64",
                  "product_id": "nodejs22-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22@22.23.2-2.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs22-main@noarch",
                "product": {
                  "name": "nodejs22-main@noarch",
                  "product_id": "nodejs22-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs22-bin@22.23.2-2.3.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs22-main@aarch64"
        },
        "product_reference": "nodejs22-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs22-main@noarch"
        },
        "product_reference": "nodejs22-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs22-main@src"
        },
        "product_reference": "nodejs22-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs22-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs22-main@x86_64"
        },
        "product_reference": "nodejs22-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56846",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:14.342521+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js\u0027s handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js HTTP/2 handling allows a remote attacker to bypass `maxSessionMemory` limits by sending specially crafted header blocks. This can lead to memory exhaustion and a denial of service for Node.js applications configured to use HTTP/2, without requiring authentication or user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56846",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.319000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks"
    },
    {
      "cve": "CVE-2026-56847",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2026-07-30T07:06:56.246824+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509178"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows trace_events.createTracing().enable() to bypass --allow-fs-write restrictions and write trace logs outside intended paths, potentially leading to unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Low impact flaw in Node.js allows a local attacker to bypass filesystem write restrictions for trace logs when using `trace_events.createTracing().enable()`. This limited integrity impact permits specific log files to be written outside the intended `--allow-fs-write` boundary.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509178",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509178"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56847"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.099000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions"
    },
    {
      "cve": "CVE-2026-56850",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-07-30T07:07:33.628354+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509179"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client\u0027s identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Node.js allows mutual TLS (mTLS) client identities to be reused across requests due to a connection reuse issue within the HTTPS Agent. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509179",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509179"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56850",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56850"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.074000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw"
    },
    {
      "cve": "CVE-2026-58039",
      "cwe": {
        "id": "CWE-73",
        "name": "External Control of File Name or Path"
      },
      "discovery_date": "2026-07-31T01:00:57.616263+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509653"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Information disclosure due to improper permission enforcement",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured `--allow-fs-write` paths by triggering `process.report`. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.\n\nRed Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).\n\nSystems and applications that do not actively enable Node.js\u0027s experimental Permission Model flag (`--experimental-permission`), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509653",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58039"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability",
          "url": "https://nodejs.org/en/blog/vulnerability"
        }
      ],
      "release_date": "2026-07-31T00:18:49.050000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Information disclosure due to improper permission enforcement"
    },
    {
      "cve": "CVE-2026-58040",
      "cwe": {
        "id": "CWE-322",
        "name": "Key Exchange without Entity Authentication"
      },
      "discovery_date": "2026-07-30T07:05:01.799571+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security (TLS) sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to information disclosure or other security breaches.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: HTTPS Agent TLS session reuse skips hostname verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is rated Moderate (CVSS 6.3) because successful exploitation allows session-hijacking and information disclosure without affecting system integrity or availability (C:H, I:N, A:N). The flaw occurs when an HTTPS Agent reuses an existing TLS session across requests with differing identity policies, skipping host verification. An attacker must already sit in a privileged network position (AV:N/AC:H) to perform a man-in-the-middle attack and intercept traffic intended for a distinct target on the same TLS session.\n\nApplications that explicitly configure unique HTTPS agents per target host, avoid TLS session caching, or do not make outbound HTTPS requests to varied third-party endpoints using shared client instances are not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58040"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:49.942000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: HTTPS Agent TLS session reuse skips hostname verification"
    },
    {
      "cve": "CVE-2026-58041",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-08-04T01:01:19.967417+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510858"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js\u0027s `node:sqlite` module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts data Integrity with zero effect on Confidentiality or Availability (C:N, I:H, A:N). Practical exploitation occurs when an application utilizes the experimental `node:sqlite` SQL tag store feature while managing statement iterators. Under these high-complexity conditions (AC:H) requiring specific user-driven interaction sequences (UI:R), a stale iterator can execute a reset statement with new parameters, leading to unintended database writes. Applications that do not use `node:sqlite` tag stores or statement iterators are completely unaffected. Red Hat and upstream CVSS scores align at 5.3 (Moderate) due to these strict operational constraints.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510858",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510858"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58041",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58041",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58041"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.112000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "Applications using Node.js that leverage the experimental `node:sqlite` SQL tag store feature should avoid using `DatabaseSync#createTagStore()` and `StatementSyncIterator` to prevent unintended data modification. If this feature is not essential, refactoring the application to remove its usage will mitigate the vulnerability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator"
    },
    {
      "cve": "CVE-2026-58042",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2026-08-04T01:01:08.018401+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510854"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service (DoS) vulnerability in Node.js allows a remote attacker to crash the application. By sending a specially crafted DNS response with an excessive number of \u0027A\u0027 records, an attacker can cause the dns.resolveAny() function to unexpectedly abort the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate DoS flaw affects Node.js applications using dns.resolveAny(). An attacker can crash the process by providing a DNS response with more than 256 \u0027A\u0027 records. Requiring the ability to manipulate DNS responses increases the attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510854",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510854"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58042",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58042"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.362000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service via DNS responses with excessive A records"
    },
    {
      "cve": "CVE-2026-58043",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-07-30T07:02:23.280145+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509171"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Node.js allows an attacker, when the Permission Model is enabled, to bypass intended filesystem access restrictions. An attacker with initial access to a permitted path could read from or write to unauthorized locations, leading to a privilege escalation within the application\u0027s sandboxing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509171",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-07-30T06:02:50.095000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw"
    },
    {
      "cve": "CVE-2026-58044",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-08-04T01:01:05.249056+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application while still using them internally for message processing. This inconsistency can allow an attacker to bypass security controls and inject malicious requests, impacting the integrity of network communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Request smuggling via HTTP client header truncation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw impacts Confidentiality and Integrity with zero effect on Availability (C:L, I:L, A:N). Practical exploitation occurs when Node.js operates as a forwarding proxy that reconstructs outbound headers from incoming requests while piping the message body over reused backend connections. Header desynchronization between internal processing and application-visible headers allows HTTP request smuggling. Standard Node.js web applications, non-proxy architectures, or proxies that do not reuse backend socket connections are completely unaffected. Red Hat assesses Confidentiality at Low (C:L) rather than None (C:N) because request smuggling in a proxy environment can expose sensitive adjacent request data, resulting in a 4.8 score versus CVEOrg\u0027s 3.7.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58044",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58044"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.297000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Request smuggling via HTTP client header truncation"
    },
    {
      "cve": "CVE-2026-58045",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-08-04T01:01:17.162622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous `node:zlib` APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs: Node.js: Denial of Service vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw strictly impacts Availability with zero effect on Confidentiality or Integrity (C:N, I:N, A:H). Practical exploitation occurs when an application passes attacker-controlled typed array objects into synchronous `node:zlib` functions, triggering an internal assertion and crashing the Node.js process. Applications using asynchronous `node:zlib` routines or processing standard binary buffers are unaffected. Both Red Hat and CVEOrg scores align at 6.2 (Moderate) with a Local attack vector (AV:L), reflecting that an attacker must be able to inject malformed array structures directly into the application\u0027s synchronous data stream.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs22-main@aarch64",
          "Red Hat Hardened Images:nodejs22-main@noarch",
          "Red Hat Hardened Images:nodejs22-main@src",
          "Red Hat Hardened Images:nodejs22-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58045",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58045"
        },
        {
          "category": "external",
          "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
          "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
        }
      ],
      "release_date": "2026-08-04T00:49:58.266000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T22:50:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48305"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs22-main@aarch64",
            "Red Hat Hardened Images:nodejs22-main@noarch",
            "Red Hat Hardened Images:nodejs22-main@src",
            "Red Hat Hardened Images:nodejs22-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs: Node.js: Denial of Service vulnerability"
    }
  ]
}