This advisory from Red Hat Product Security addresses a security vulnerability in Node.js 22 on Red Hat Enterprise Linux 10, specifically a remote crash issue via the SignTraits::DeriveBits() function (CVE-2025-23166). The vulnerability is classified under CWE-401 (improper release of memory) and CWE-248 (uncaught exception). The update fixes this issue by providing patched Node.js 22 packages for various architectures. The advisory includes references to CVE-2025-23165 and CVE-2025-23166 and directs users to apply the update to mitigate the risk. No CVSS score is provided, but the severity is rated as high by Red Hat.

The vulnerability could allow an attacker to remotely cause a crash in Node.js, potentially leading to denial of service conditions. The impact is limited to remote crash scenarios and does not explicitly mention code execution or data compromise. Red Hat rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 10 that fix this vulnerability. Users should apply the security update as described in the Red Hat advisory RHSA-2025:8493 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are specified or required beyond applying the official update.