Red Hat Product Security released an advisory (RHSA-2026:2783) for the Node.js 20 module in Red Hat Enterprise Linux 9, addressing six security vulnerabilities. These include two filesystem permissions bypass issues (CVE-2025-55130, CVE-2025-55132), three denial of service vulnerabilities (CVE-2026-21637, CVE-2025-59465, CVE-2025-59466), and one uninitialized memory exposure (CVE-2025-55131). The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64, as well as extended update support versions. Red Hat has provided updated packages to fix these vulnerabilities. No CVSS scores are provided in the advisory, but the severity is rated as Important (high). No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities allow attackers to bypass filesystem permissions, cause denial of service conditions, and potentially expose uninitialized memory in Node.js applications running on affected Red Hat Enterprise Linux 9 systems. These issues could lead to unauthorized access to files, application crashes, or leakage of sensitive information. The impact is considered high due to the nature of the flaws and their potential to disrupt applications or compromise data confidentiality.

Red Hat has released updated Node.js 20 module packages that address these vulnerabilities. Administrators should apply the security update as detailed in Red Hat advisory RHSA-2026:2783 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended and effective mitigation. No additional vendor-recommended mitigations or workarounds are indicated.