The advisory covers three security fixes for Node.js 22 on Red Hat Enterprise Linux 8. CVE-2025-22150 addresses insufficiently random values used by the undici HTTP client library, which could impact security. CVE-2025-23083 involves exposure of Node.js worker threads through the diagnostics channel, potentially leaking sensitive information. CVE-2025-23085 is a memory leak vulnerability triggered by GOAWAY HTTP/2 frames causing memory consumption outside the heap. Red Hat has released an updated Node.js 22 package to remediate these issues. The advisory references Red Hat's official errata RHSA-2025:1611 for detailed patch instructions.

These vulnerabilities collectively pose a high security risk by potentially allowing information exposure and resource exhaustion through memory leaks. The insufficient randomness in undici could weaken cryptographic operations or session security. Worker thread exposure may lead to unintended disclosure of internal state or data. The memory leak could degrade system stability or availability over time. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released an updated Node.js 22 package for Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:1611 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor-recommended mitigations are indicated.