Red Hat Security Advisory: nodejs:22 security update
A security update for Node.js 22 on Red Hat Enterprise Linux 8 addresses a vulnerability identified as CVE-2025-23166, which allows a remote crash via the SignTraits::DeriveBits() function. This vulnerability is rated as having an important security impact by Red Hat Product Security. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS score is provided, but the severity is considered high. The update rebases Node.js 22 to the latest release to mitigate this issue. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
The Red Hat security advisory RHSA-2025:8506 addresses a vulnerability in Node.js 22 on Red Hat Enterprise Linux 8, specifically CVE-2025-23166, which causes a remote crash via the SignTraits::DeriveBits() function. This vulnerability is related to improper resource management (CWE-401) and potentially improper error handling (CWE-248). The update rebases Node.js 22 to the latest upstream release to fix this issue. The advisory applies to multiple architectures and variants of Red Hat Enterprise Linux 8, including Extended Life Cycle versions. No CVSS score is provided, and no known exploits are reported in the wild. The vendor advisory recommends applying the update available through Red Hat channels.
Potential Impact
The vulnerability allows remote attackers to cause a crash in Node.js 22, potentially leading to denial of service conditions. The impact is rated as important (high severity) by Red Hat Product Security. There is no indication of code execution or data compromise from the provided information. No known exploits are currently observed in the wild.
Mitigation Recommendations
Red Hat has released an updated Node.js 22 package for Red Hat Enterprise Linux 8 that addresses this vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2025:8506 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the issue. No additional mitigation steps are indicated by the vendor.
Red Hat Security Advisory: nodejs:22 security update
Description
A security update for Node.js 22 on Red Hat Enterprise Linux 8 addresses a vulnerability identified as CVE-2025-23166, which allows a remote crash via the SignTraits::DeriveBits() function. This vulnerability is rated as having an important security impact by Red Hat Product Security. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS score is provided, but the severity is considered high. The update rebases Node.js 22 to the latest release to mitigate this issue. No known exploits are reported in the wild at this time.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat security advisory RHSA-2025:8506 addresses a vulnerability in Node.js 22 on Red Hat Enterprise Linux 8, specifically CVE-2025-23166, which causes a remote crash via the SignTraits::DeriveBits() function. This vulnerability is related to improper resource management (CWE-401) and potentially improper error handling (CWE-248). The update rebases Node.js 22 to the latest upstream release to fix this issue. The advisory applies to multiple architectures and variants of Red Hat Enterprise Linux 8, including Extended Life Cycle versions. No CVSS score is provided, and no known exploits are reported in the wild. The vendor advisory recommends applying the update available through Red Hat channels.
Potential Impact
The vulnerability allows remote attackers to cause a crash in Node.js 22, potentially leading to denial of service conditions. The impact is rated as important (high severity) by Red Hat Product Security. There is no indication of code execution or data compromise from the provided information. No known exploits are currently observed in the wild.
Mitigation Recommendations
Red Hat has released an updated Node.js 22 package for Red Hat Enterprise Linux 8 that addresses this vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2025:8506 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the issue. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:8506
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-23166"]
Threat ID: 6a4049e427e9c79719833c5a
Added to database: 06/27/2026, 22:08:36 UTC
Last enriched: 08/07/2026, 00:49:24 UTC
Last updated: 09/10/2026, 19:24:55 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.