Red Hat Security AdvisoryRHSA-2025:8467
nodejs:22 security update
Released 2025-06-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.16.0-1.module+el9.6.0+23151+b1496e9d.aarch64::nodejs:22, nodejs-1:22.16.0-1.module+el9.6.0+23151+b1496e9d.ppc64le::nodejs:22, nodejs-1:22.16.0-1.module+el9.6.0+23151+b1496e9d.s390x::nodejs:22 +28
Fixes 2 records
Priority MEDIUM 51
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set.
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.00557 · Published 2025-05-19 · Fixed CWE-401
Priority MEDIUM 40
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00817 · Published 2025-05-19 · Fixed CWE-248
