Red Hat Security Advisory: nodejs22 security update
Multiple security vulnerabilities have been identified in the Node.js 22 package distributed with Red Hat Enterprise Linux 10.0 Extended Update Support. These include a denial of service, uninitialized memory exposure, and file permissions bypass issues. Red Hat has issued an important security advisory (RHSA-2026:2899) addressing these vulnerabilities with updated packages. The vulnerabilities affect Node.js 22.22.0-1.el10_0 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory. The update is available and should be applied to remediate these issues.
AI Analysis
Technical Summary
Red Hat Product Security released an advisory (RHSA-2026:2899) for Node.js 22 on Red Hat Enterprise Linux 10.0 Extended Update Support addressing multiple vulnerabilities: CVE-2025-59465 (denial of service), CVE-2025-55131 (uninitialized memory exposure), and CVE-2025-55130 (file permissions bypass). These vulnerabilities impact the Node.js 22.22.0-1.el10_0 package on various architectures. The advisory rates the security impact as Important (high severity) and provides updated packages to fix these issues. The advisory references multiple CVEs but does not include CVSS scores. The vendor provides a solution via updated packages available through Red Hat's update channels.
Potential Impact
The vulnerabilities include denial of service, exposure of uninitialized memory, and bypass of file permissions controls in Node.js 22 on Red Hat Enterprise Linux 10.0. These issues could allow attackers to disrupt service, access sensitive memory contents, or bypass security restrictions related to file permissions. The overall security impact is rated as Important by Red Hat, indicating a high severity level that could affect confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the security update RHSA-2026:2899 promptly by following Red Hat's official update procedures described at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided update.
Red Hat Security Advisory: nodejs22 security update
Description
Multiple security vulnerabilities have been identified in the Node.js 22 package distributed with Red Hat Enterprise Linux 10.0 Extended Update Support. These include a denial of service, uninitialized memory exposure, and file permissions bypass issues. Red Hat has issued an important security advisory (RHSA-2026:2899) addressing these vulnerabilities with updated packages. The vulnerabilities affect Node.js 22.22.0-1.el10_0 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory. The update is available and should be applied to remediate these issues.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security released an advisory (RHSA-2026:2899) for Node.js 22 on Red Hat Enterprise Linux 10.0 Extended Update Support addressing multiple vulnerabilities: CVE-2025-59465 (denial of service), CVE-2025-55131 (uninitialized memory exposure), and CVE-2025-55130 (file permissions bypass). These vulnerabilities impact the Node.js 22.22.0-1.el10_0 package on various architectures. The advisory rates the security impact as Important (high severity) and provides updated packages to fix these issues. The advisory references multiple CVEs but does not include CVSS scores. The vendor provides a solution via updated packages available through Red Hat's update channels.
Potential Impact
The vulnerabilities include denial of service, exposure of uninitialized memory, and bypass of file permissions controls in Node.js 22 on Red Hat Enterprise Linux 10.0. These issues could allow attackers to disrupt service, access sensitive memory contents, or bypass security restrictions related to file permissions. The overall security impact is rated as Important by Red Hat, indicating a high severity level that could affect confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the security update RHSA-2026:2899 promptly by following Red Hat's official update procedures described at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:2899
- Cve Count
- 5
- Additional Cves
- ["CVE-2025-55131","CVE-2025-59465","CVE-2025-59466","CVE-2026-21637"]
Threat ID: 6a27e9938dd33fbd8516ab72
Added to database: 06/09/2026, 10:23:15 UTC
Last enriched: 06/27/2026, 23:50:22 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 213
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.