RHSA-2025:1582MediumCVSS 6.8

Red Hat Security Advisory: nodejs:18 security update

Published
February 17, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (2)

CVE-2025-23085 →CVE-2025-22150 →

📋 Description

CVE-2025-22150 — undici: Undici Uses Insufficiently Random Values CVE-2025-23085 — nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.s390x (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:18.20.6-1.module+el8.10.0+22776+24cd6c55.x86_64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:3.0.1-1.module+el8.10.0+21159+f5a7145d.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:3.0.1-1.module+el8.10.0+21159+f5a7145d.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:2021.06-4.module+el8.9.0+19439+7b18b275.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:2021.06-4.module+el8.9.0+19439+7b18b275.src (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19439+7b18b275.noarch (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:10.8.2-1.18.20.6.1.module+el8.10.0+22776+24cd6c55.aarch64 (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:10.8.2-1.18.20.6.1.module+el8.10.0+22776+24cd6c55.ppc64le (nodejs:18) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There's no available mitigation for this issue other than updating to the package version which contains the fix.

🔗 References (5)