This advisory covers three security flaws in Node.js 22 as packaged by Red Hat for RHEL 8. CVE-2025-22150 concerns undici using insufficiently random values, which could affect cryptographic or security operations relying on randomness. CVE-2025-23083 involves exposure of Node.js worker threads through the diagnostics channel, potentially leaking sensitive information. CVE-2025-23085 is a memory leak vulnerability triggered by GOAWAY HTTP/2 frames causing memory consumption outside the heap. Red Hat has released updated packages for multiple architectures to fix these issues.

The vulnerabilities could lead to weakened security guarantees due to insufficient randomness, potential exposure of worker thread information, and resource exhaustion via memory leaks. The overall security impact is rated as Important by Red Hat, indicating these issues could affect confidentiality, integrity, or availability if exploited. No known exploits in the wild have been reported at this time.

Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update RHSA-2025:1611 as detailed in the Red Hat advisory (https://access.redhat.com/errata/RHSA-2025:1611) and the update instructions (https://access.redhat.com/articles/11258). No additional mitigation steps are specified or required beyond applying the official update.