Local server can be started without network permission via Permission API flaw

Summary

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**. A flaw was found in Node.js. The Node.js Permission API can allow a local server to be started through a Unix domain socket, even when the `--allow-net` permission is not explicitly granted. This bypasses intended security restrictions, potentially leading to unintended local network exposure or integrity impact. Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-648. Fixed by RHSA-2026:33866, RHSA-2026:34478, RHSA-2026:7378, RHSA-2026:9455 — update the affected packages (`sudo dnf update`). Affected Red Hat products: Red Hat Hardened Images.