This Red Hat security advisory (RHSA-2025:1613) addresses three vulnerabilities in the nodejs:22 module for Red Hat Enterprise Linux 9. CVE-2025-22150 concerns undici using insufficiently random values (CWE-330). CVE-2025-23083 involves exposure of Node.js worker threads via the diagnostics channel (CWE-863). CVE-2025-23085 describes a memory leak outside the heap triggered by GOAWAY HTTP/2 frames (CWE-400). The advisory provides updated packages to fix these issues and recommends applying the update to affected systems. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat.

The vulnerabilities could lead to security weaknesses including insufficient randomness potentially affecting cryptographic operations, exposure of worker threads that may leak sensitive information, and memory leaks that could degrade system stability or lead to denial of service. The advisory does not report known exploits in the wild. The impact is rated as important, indicating a significant security risk if unpatched.

Red Hat has released updated nodejs:22 packages for Red Hat Enterprise Linux 9 and its variants that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2025:1613 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.