This advisory covers three security fixes in Node.js 22 module on Red Hat Enterprise Linux 9. CVE-2025-22150 addresses insufficiently random values used by the undici HTTP client library, which could impact cryptographic strength or randomness assumptions. CVE-2025-23083 involves exposure of Node.js worker threads through the diagnostics channel, potentially leaking internal information. CVE-2025-23085 fixes a memory leak outside the heap caused by GOAWAY HTTP/2 frames, which could lead to resource exhaustion. Red Hat has issued updated packages for affected versions to mitigate these vulnerabilities.

The vulnerabilities collectively pose risks including potential information exposure (worker thread diagnostics channel), weakened randomness which could affect security mechanisms relying on random values, and memory leaks that may degrade system stability or availability. The advisory rates the overall security impact as Important to Moderate depending on the specific vulnerability. No known exploits in the wild have been reported at this time.

Red Hat has released updated Node.js 22 module packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security updates as detailed in Red Hat advisory RHSA-2025:1613 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No additional mitigations are specified or required beyond updating to the fixed versions.