RHSA-2025:1446MediumCVSS 6.8

Red Hat Security Advisory: nodejs:18 security update

Published
February 13, 2025
Last Modified
August 9, 2026

🔗 CVE IDs covered (2)

CVE-2025-22150 →CVE-2025-23085 →

📋 Description

CVE-2025-22150 — undici: Undici Uses Insufficiently Random Values CVE-2025-23085 — nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.20.6-1.module+el9.5.0+22773+9a359385.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.20.6-1.module+el9.5.0+22773+9a359385.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.20.6-1.module+el9.5.0+22773+9a359385.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.20.6-1.module+el9.5.0+22773+9a359385.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:18.20.6-1.module+el9.5.0+22773+9a359385.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.20.6-1.module+el9.5.0+22773+9a359385.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.20.6-1.module+el9.5.0+22773+9a359385.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.20.6-1.module+el9.5.0+22773+9a359385.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:18.20.6-1.module+el9.5.0+22773+9a359385.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.20.6-1.module+el9.5.0+22773+9a359385.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.20.6-1.module+el9.5.0+22773+9a359385.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.20.6-1.module+el9.5.0+22773+9a359385.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:18.20.6-1.module+el9.5.0+22773+9a359385.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.20.6-1.module+el9.5.0+22773+9a359385.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.20.6-1.module+el9.5.0+22773+9a359385.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.20.6-1.module+el9.5.0+22773+9a359385.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:18.20.6-1.module+el9.5.0+22773+9a359385.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:18.20.6-1.module+el9.5.0+22773+9a359385.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.20.6-1.module+el9.5.0+22773+9a359385.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.20.6-1.module+el9.5.0+22773+9a359385.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.20.6-1.module+el9.5.0+22773+9a359385.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:18.20.6-1.module+el9.5.0+22773+9a359385.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-nodemon-0:3.0.1-1.module+el9.5.0+22773+9a359385.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-nodemon-0:3.0.1-1.module+el9.5.0+22773+9a359385.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-packaging-0:2021.06-4.module+el9.5.0+22773+9a359385.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-packaging-0:2021.06-4.module+el9.5.0+22773+9a359385.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-packaging-bundler-0:2021.06-4.module+el9.5.0+22773+9a359385.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • npm-1:10.8.2-1.18.20.6.1.module+el9.5.0+22773+9a359385.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • npm-1:10.8.2-1.18.20.6.1.module+el9.5.0+22773+9a359385.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There's no available mitigation for this issue other than updating to the package version which contains the fix.

🔗 References (5)