RHSA-2025:1613HighCVSS 7.7

Red Hat Security Advisory: nodejs:22 security update

Published
February 17, 2025
Last Modified
August 15, 2026

🔗 CVE IDs covered (3)

CVE-2025-23083 →CVE-2025-23085 →CVE-2025-22150 →

📋 Description

CVE-2025-22150 — undici: Undici Uses Insufficiently Random Values CVE-2025-23083 — nodejs: Node.js Worker Thread Exposure via Diagnostics Channel CVE-2025-23085 — nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap

🎯 Affected products44

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:22.13.1-1.module+el9.5.0+22763+17233acb.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:22.13.1-1.module+el9.5.0+22763+17233acb.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:22.13.1-1.module+el9.5.0+22763+17233acb.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:22.13.1-1.module+el9.5.0+22763+17233acb.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:22.13.1-1.module+el9.5.0+22763+17233acb.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:22.13.1-1.module+el9.5.0+22763+17233acb.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:22.13.1-1.module+el9.5.0+22763+17233acb.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:22.13.1-1.module+el9.5.0+22763+17233acb.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: There's no available mitigation for this issue other than updating to the package version which contains the fix.

🔗 References (6)