RHSA-2026:89206HighCVSS 7.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 25, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-105483 →

📋 Description

CVE-2026-105483 — nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames

🎯 Affected products29

  • Red Hat Hardened Images
  • nodejs24-1:24.22.1-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs24-1:24.22.1-3.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs24-1:24.22.1-3.hum1@src as a component of Red Hat Hardened Images
  • nodejs24-1:24.22.1-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs24-bin-1:24.22.1-3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs24-bin-1:24.22.1-3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs24-bin-1:24.22.1-3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs24-devel-1:24.22.1-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs24-devel-1:24.22.1-3.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs24-devel-1:24.22.1-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs24-docs-1:24.22.1-3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs24-docs-1:24.22.1-3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs24-docs-1:24.22.1-3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs24-full-i18n-1:24.22.1-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs24-full-i18n-1:24.22.1-3.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs24-full-i18n-1:24.22.1-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs24-libs-1:24.22.1-3.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs24-libs-1:24.22.1-3.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs24-libs-1:24.22.1-3.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs24-npm-2:11.19.1-1.24.22.1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs24-npm-2:11.19.1-1.24.22.1.3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs24-npm-2:11.19.1-1.24.22.1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs24-npm-bin-2:24.22.1-3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs24-npm-bin-2:24.22.1-3.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs24-npm-bin-2:24.22.1-3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • v8-13.6-devel-3:13.6.233.17-1.24.22.1.3.hum1@aarch64 as a component of Red Hat Hardened Images
  • v8-13.6-devel-3:13.6.233.17-1.24.22.1.3.hum1@s390x as a component of Red Hat Hardened Images
  • v8-13.6-devel-3:13.6.233.17-1.24.22.1.3.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.

🔗 References (5)