Red Hat Security Advisory: nodejs:20 security update
A security update for Node.js 20 on Red Hat Enterprise Linux 9.4 addresses a vulnerability identified as CVE-2025-23166. The issue involves a remote crash triggered via the SignTraits::DeriveBits() function in Node.js. Red Hat has rated this update as important and has released updated packages to remediate the vulnerability. The advisory applies to multiple architectures and extended update support versions of Red Hat Enterprise Linux 9.4. No CVSS score is provided, but the severity is assessed as high by Red Hat. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
CVE-2025-23166 is a vulnerability in Node.js 20 affecting Red Hat Enterprise Linux 9.4 Extended Update Support. It allows a remote crash via the SignTraits::DeriveBits() function. Red Hat Product Security has issued an important security advisory (RHSA-2025:8902) and released updated Node.js 20.19.2 packages to fix this issue. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerability is classified under CWE-248. No detailed CVSS score is provided in the advisory, and no known exploits are reported in the wild.
Potential Impact
The vulnerability allows remote attackers to cause a crash in Node.js, potentially leading to denial of service. The impact is rated as important (high severity) by Red Hat. There is no indication of code execution or data compromise from the provided information. No active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 9.4 Extended Update Support to address this vulnerability. Users should apply the security update as described in the Red Hat advisory RHSA-2025:8902 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official update.
Red Hat Security Advisory: nodejs:20 security update
Description
A security update for Node.js 20 on Red Hat Enterprise Linux 9.4 addresses a vulnerability identified as CVE-2025-23166. The issue involves a remote crash triggered via the SignTraits::DeriveBits() function in Node.js. Red Hat has rated this update as important and has released updated packages to remediate the vulnerability. The advisory applies to multiple architectures and extended update support versions of Red Hat Enterprise Linux 9.4. No CVSS score is provided, but the severity is assessed as high by Red Hat. There are no known exploits in the wild at this time.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-23166 is a vulnerability in Node.js 20 affecting Red Hat Enterprise Linux 9.4 Extended Update Support. It allows a remote crash via the SignTraits::DeriveBits() function. Red Hat Product Security has issued an important security advisory (RHSA-2025:8902) and released updated Node.js 20.19.2 packages to fix this issue. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerability is classified under CWE-248. No detailed CVSS score is provided in the advisory, and no known exploits are reported in the wild.
Potential Impact
The vulnerability allows remote attackers to cause a crash in Node.js, potentially leading to denial of service. The impact is rated as important (high severity) by Red Hat. There is no indication of code execution or data compromise from the provided information. No active exploitation has been reported.
Mitigation Recommendations
Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 9.4 Extended Update Support to address this vulnerability. Users should apply the security update as described in the Red Hat advisory RHSA-2025:8902 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated or required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:8902
- Cve Count
- 1
Threat ID: 6a4049e127e9c797198325f5
Added to database: 06/27/2026, 22:08:33 UTC
Last enriched: 08/07/2026, 00:49:01 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.