This advisory covers several security vulnerabilities in Node.js 22 as packaged for Red Hat Enterprise Linux 10.0 EUS. The identified issues include a denial of service vulnerability (CVE-2025-59465), an uninitialized memory exposure (CVE-2025-55131), and a file permissions bypass vulnerability (CVE-2025-55130). These vulnerabilities have been fixed in the nodejs22-22.22.0-1.el10_0 package update. The advisory is rated as important by Red Hat and applies to multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory, but the severity is classified as high.

The vulnerabilities could allow an attacker to cause a denial of service, expose uninitialized memory potentially leading to information disclosure, or bypass file permissions controls. These impacts could affect the confidentiality, integrity, and availability of systems running the affected Node.js version on Red Hat Enterprise Linux 10.0 EUS.

Red Hat has released updated nodejs22 packages (version 22.22.0-1.el10_0) that address these vulnerabilities. Users should apply the security update as described in Red Hat's advisory RHSA-2026:2899 and the referenced article https://access.redhat.com/articles/11258. This update is available for all supported architectures and variants of Red Hat Enterprise Linux 10.0 EUS. No additional mitigation steps are indicated beyond applying the official update.