Red Hat Product Security issued an advisory (RHSA-2025:8506) for Node.js 22 on Red Hat Enterprise Linux 8 addressing a remote crash vulnerability identified as CVE-2025-23166. The vulnerability involves the SignTraits::DeriveBits() function, which can be triggered remotely to cause a crash. The advisory includes fixes rebasing Node.js 22 to the latest release and is rated as Important severity by Red Hat. The update applies to multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS score is provided in the advisory, and no exploits are known to be active in the wild. The advisory references Red Hat's update article for applying the patch.

The vulnerability allows a remote attacker to cause a crash in Node.js via the SignTraits::DeriveBits() function, resulting in denial of service conditions. There is no indication of code execution or data compromise. No known exploits are reported in the wild at this time.

Red Hat has released an official security update for Node.js 22 on Red Hat Enterprise Linux 8 that addresses this vulnerability. Users should apply the update as described in Red Hat's advisory and update article (https://access.redhat.com/articles/11258) to remediate the issue. No additional mitigation steps are indicated by the vendor.