Red Hat Security AdvisoryRHSA-2025:8514
nodejs:20 security update
Released 2025-06-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20, nodejs-1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20, nodejs-1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20 +20
Fixes 3 records
Priority MEDIUM 51
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set.
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.00557 · Published 2025-05-19 · Fixed CWE-401
Priority MEDIUM 40
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00817 · Published 2025-05-19 · Fixed CWE-248
Priority LOW 35
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.
CVSS 3.0MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00508 · Published 2025-05-19 · Fixed CWE-444
THREATIST.IORead the docs