RHSA-2025:1351HighCVSS 7.7

Red Hat Security Advisory: nodejs:20 security update

Published
February 12, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (3)

CVE-2025-22150 →CVE-2025-23083 →CVE-2025-23085 →

📋 Description

CVE-2025-22150 — undici: Undici Uses Insufficiently Random Values CVE-2025-23083 — nodejs: Node.js Worker Thread Exposure via Diagnostics Channel CVE-2025-23085 — nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.18.2-1.module+el8.10.0+22767+a3309b10.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.18.2-1.module+el8.10.0+22767+a3309b10.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.18.2-1.module+el8.10.0+22767+a3309b10.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.18.2-1.module+el8.10.0+22767+a3309b10.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:20.18.2-1.module+el8.10.0+22767+a3309b10.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.18.2-1.module+el8.10.0+22767+a3309b10.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.18.2-1.module+el8.10.0+22767+a3309b10.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.18.2-1.module+el8.10.0+22767+a3309b10.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:20.18.2-1.module+el8.10.0+22767+a3309b10.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.18.2-1.module+el8.10.0+22767+a3309b10.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.18.2-1.module+el8.10.0+22767+a3309b10.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.18.2-1.module+el8.10.0+22767+a3309b10.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:20.18.2-1.module+el8.10.0+22767+a3309b10.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.18.2-1.module+el8.10.0+22767+a3309b10.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.18.2-1.module+el8.10.0+22767+a3309b10.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.18.2-1.module+el8.10.0+22767+a3309b10.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:20.18.2-1.module+el8.10.0+22767+a3309b10.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:20.18.2-1.module+el8.10.0+22767+a3309b10.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.18.2-1.module+el8.10.0+22767+a3309b10.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.18.2-1.module+el8.10.0+22767+a3309b10.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.18.2-1.module+el8.10.0+22767+a3309b10.s390x (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:20.18.2-1.module+el8.10.0+22767+a3309b10.x86_64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:3.0.1-1.module+el8.10.0+22767+a3309b10.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:3.0.1-1.module+el8.10.0+22767+a3309b10.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:2021.06-4.module+el8.10.0+22767+a3309b10.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:2021.06-4.module+el8.10.0+22767+a3309b10.src (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-bundler-0:2021.06-4.module+el8.10.0+22767+a3309b10.noarch (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:10.8.2-1.20.18.2.1.module+el8.10.0+22767+a3309b10.aarch64 (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:10.8.2-1.20.18.2.1.module+el8.10.0+22767+a3309b10.ppc64le (nodejs:20) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There's no available mitigation for this issue other than updating to the package version which contains the fix.

🔗 References (6)