Red Hat issued a security advisory (RHSA-2025:1351) for Node.js 20 on Red Hat Enterprise Linux 8 addressing three vulnerabilities: CVE-2025-22150 in the undici library involving insufficiently random values, CVE-2025-23083 involving exposure of worker threads through the diagnostics channel, and CVE-2025-23085 involving a memory leak triggered by GOAWAY HTTP/2 frames. These vulnerabilities correspond to CWE-330 (Insufficient Entropy), CWE-863 (Incorrect Authorization), and CWE-400 (Uncontrolled Resource Consumption). The advisory provides updated packages to fix these issues. No CVSS scores are provided in the advisory, but Red Hat rates the update as Important. The advisory includes instructions and links for applying the update on various Red Hat Enterprise Linux 8 architectures.

The vulnerabilities could lead to security issues such as predictable random values in the undici HTTP client, potential exposure of worker thread information via the diagnostics channel, and memory leaks caused by malformed HTTP/2 frames. These issues may affect the confidentiality, integrity, or availability of applications using Node.js 20 on Red Hat Enterprise Linux 8. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated Node.js 20 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:1351 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix from the vendor, applying the update is the recommended remediation. No additional mitigation steps are indicated by the vendor.