Red Hat Product Security has released an important security update for the Node.js 20 module in Red Hat Enterprise Linux 9.4 Extended Update Support. The update addresses multiple vulnerabilities: CVE-2025-59465 (denial of service), CVE-2025-55131 (uninitialized memory exposure), and CVE-2025-55130 (file permissions bypass). These vulnerabilities could impact the security of Node.js applications by allowing denial of service, exposure of uninitialized memory, or bypassing file permission controls. The advisory references additional CVEs related to Node.js. The update is available via Red Hat's errata RHSA-2026:2768 and includes fixes for these issues.

The vulnerabilities include denial of service, which could disrupt Node.js applications; uninitialized memory exposure, potentially leaking sensitive information; and file permissions bypass, which could allow unauthorized access or modification of files. These issues collectively pose a high security risk to systems running the affected Node.js 20 module on Red Hat Enterprise Linux 9.4. No known exploits in the wild have been reported at this time.

Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:2768 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is a traditional software package, remediation requires applying the vendor-provided update. Patch status is confirmed by the vendor advisory.