Red Hat Product Security issued an important security advisory (RHSA-2025:8493) for nodejs22 on Red Hat Enterprise Linux 10, addressing a remote crash vulnerability via the SignTraits::DeriveBits() function in Node.js (CVE-2025-23166). The advisory also references CVE-2025-23165. The vulnerability could cause a remote crash, impacting the stability of Node.js applications. The advisory provides updated packages for multiple architectures and extended update support versions of Red Hat Enterprise Linux 10. No CVSS score is provided, but the severity is rated as important by Red Hat. The advisory includes instructions and links for applying the update.

The vulnerability allows a remote crash of Node.js processes via the SignTraits::DeriveBits() function, potentially leading to denial of service conditions for applications relying on Node.js. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical compromise or code execution. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated nodejs22 packages for Red Hat Enterprise Linux 10 that address this vulnerability. Users should apply the provided security update as detailed in the Red Hat advisory RHSA-2025:8493 and the referenced article https://access.redhat.com/articles/11258. Applying this update remediates the vulnerability. No additional mitigation steps are indicated by the vendor.