Red Hat Product Security issued an advisory (RHSA-2025:1443) for Node.js 20 on Red Hat Enterprise Linux 9, addressing three vulnerabilities: CVE-2025-22150 in the undici HTTP client due to insufficiently random values, CVE-2025-23083 involving exposure of worker threads through the diagnostics channel, and CVE-2025-23085 where GOAWAY HTTP/2 frames cause a memory leak outside the heap. The advisory rates the update as important and provides updated packages for multiple RHEL 9 variants and architectures. The advisory references CVE pages for detailed impact and CVSS scores but does not provide CVSS scores itself. No exploits in the wild are currently known. The update is available and should be applied to affected systems.

The vulnerabilities could lead to security issues such as weakened randomness affecting cryptographic operations (CVE-2025-22150), potential exposure of internal worker thread information (CVE-2025-23083), and memory leaks that could degrade system stability or lead to denial of service (CVE-2025-23085). The exact impact severity is rated as important by Red Hat, but no active exploitation has been reported.

Red Hat has released an official security update for Node.js 20 in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2025:1443 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the issues. No additional mitigation steps are indicated by the vendor.