Red Hat issued a security advisory (RHSA-2026:2422) for Node.js 20 in Red Hat Enterprise Linux 8 addressing six vulnerabilities: CVE-2025-55130 and CVE-2025-55132 (filesystem permissions bypass), CVE-2025-55131 (uninitialized memory exposure), CVE-2025-59465, CVE-2025-59466, and CVE-2026-21637 (denial of service). The update rebases Node.js 20 to the latest upstream release, resolving these issues. The advisory provides updated packages for multiple architectures and references Red Hat knowledge base article 11258 for update instructions. No CVSS scores are provided in the advisory, but the impact is rated Important by Red Hat Product Security.

The vulnerabilities include bypass of filesystem permissions which could allow unauthorized access to files, denial of service conditions that could disrupt application availability, and exposure of uninitialized memory which may lead to information disclosure. These issues affect Node.js 20 as packaged by Red Hat for RHEL 8 across multiple hardware architectures. The impact is rated Important (high severity) by Red Hat, indicating significant security concerns that warrant prompt remediation.

Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities by rebasing to the latest upstream Node.js 20 release. Users should apply the security update as detailed in Red Hat article 11258 (https://access.redhat.com/articles/11258) to remediate these issues. No indication is given that the vulnerabilities are already mitigated or require no action. Patch status is confirmed by the vendor advisory.