TKGI and CVE-2026-48618, CVE-2026-48619, CVE-2026-48928, CVE-2026-48930, CVE-2026-48931

Products

• VMware Tanzu Kubernetes Grid Integrated Edition

Issue/Introduction

Security scanners or compliance audits may flag TKGI environments for vulnerabilities related to Node.js (specifically versions below 22.23.0).

These CVEs typically involve TLS handling and potential denial of service or information disclosure within the Node.js runtime.

Node.js related link with these vulnerabilities https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

 

Environment

VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)

Operations Manager

Cause

These vulnerabilities are identified in the Node.js runtime. Security scanners flag these because they detect the presence of Node.js in the environment or assume its use in core networking components.

Resolution

The following components are described below and their impact:

• TKGI Tile and Cluster VMs: Node.js is not bundled or installed as part of the TKGI Tile or the Kubernetes cluster VMs (Master/Worker nodes). Therefore, the core platform is not vulnerable.
• Customer Workloads: If customer-deployed pods (such as custom ingress controllers or applications) use Node.js, they must be updated independently by the customer using patched container images.
• Operations Manager: While Operations Manager contains the ensemble-stitching service which runs on Node.js, the impact is mitigated. Incoming TLS traffic is terminated by an Nginx proxy, and internal communication to the Node.js service is handled over plain text, preventing exploitation of these TLS-specific vulnerabilities.

Broadcom Engineering is planning to include updated Node.js versions in future maintenance releases of management components (like Operations Manager) as part of regular security hardening.