The Red Hat Security Advisory RHSA-2025:1582 reports two vulnerabilities affecting Node.js 18 on Red Hat Enterprise Linux 8. CVE-2025-22150 concerns the undici HTTP client library using insufficiently random values, classified under CWE-330 (Use of Insufficiently Random Values). CVE-2025-23085 involves a memory leak triggered by GOAWAY HTTP/2 frames occurring outside the heap, classified under CWE-400 (Uncontrolled Resource Consumption). The advisory provides updated Node.js 18 packages (version 18.20.6) that address these vulnerabilities. The affected versions are Node.js 18 releases from 18.0.0 up to but not including 18.20.6. The advisory does not provide CVSS scores but rates the impact as moderate. There are no known exploits in the wild. The vendor provides detailed update instructions and package downloads via the Red Hat Customer Portal.

The vulnerabilities could potentially weaken cryptographic operations due to insufficient randomness in the undici library and cause resource exhaustion or denial of service due to a memory leak triggered by malformed HTTP/2 GOAWAY frames. The impact is rated moderate by Red Hat. No active exploitation is known. Systems running affected Node.js 18 versions on Red Hat Enterprise Linux 8 are at risk until updated.

Red Hat has released updated Node.js 18 packages (version 18.20.6) that fix these vulnerabilities. Users should apply the official Red Hat update as described in the advisory (RHSA-2025:1582) and the linked article https://access.redhat.com/articles/11258. No additional mitigations are indicated or required beyond applying this update.