Red Hat issued a security advisory (RHSA-2026:2864) for the Node.js 22 module in Red Hat Enterprise Linux 9.6 Extended Update Support. The advisory addresses multiple vulnerabilities: a denial of service (CVE-2025-59465), uninitialized memory exposure (CVE-2025-55131), and a file permissions bypass (CVE-2025-55130). These vulnerabilities could impact the security of Node.js applications running on affected Red Hat systems. The advisory provides updated packages to fix these issues. The vendor rates the update as important and recommends applying the update to affected systems. No CVSS base scores are included in the advisory, and no known exploits in the wild are reported.

The vulnerabilities include denial of service, exposure of uninitialized memory, and bypass of file permissions controls in Node.js. These could lead to service disruption, potential information leakage, and unauthorized file access or modification. The exact impact severity is rated as important by Red Hat, indicating a high risk to affected systems if unpatched.

Red Hat has released an official security update for Node.js 22 module in Red Hat Enterprise Linux 9.6 to address these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:2864 and the referenced update instructions at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities.