Red Hat Security AdvisoryRHSA-2025:8506
nodejs:22 security update
Released 2025-06-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.16.0-1.module+el8.10.0+23140+4056b950.aarch64::nodejs:22, nodejs-1:22.16.0-1.module+el8.10.0+23140+4056b950.ppc64le::nodejs:22, nodejs-1:22.16.0-1.module+el8.10.0+23140+4056b950.s390x::nodejs:22 +28
Fixes 2 records
Priority MEDIUM 51
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set.
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.00557 · Published 2025-05-19 · Fixed CWE-401
Priority MEDIUM 40
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00817 · Published 2025-05-19 · Fixed CWE-248
