Red Hat issued a security update for the Node.js 22 module in Red Hat Enterprise Linux 9 to fix six vulnerabilities: two filesystem permissions bypasses (CVE-2025-55130, CVE-2025-55132), three denial of service issues (CVE-2025-59465, CVE-2025-59466, CVE-2026-21637), and one uninitialized memory exposure (CVE-2025-55131). These vulnerabilities could allow unauthorized access to filesystem permissions, cause denial of service conditions, or expose uninitialized memory. The advisory references Red Hat Bugzilla entries for each CVE and provides updated packages to remediate the issues.

The vulnerabilities impact Node.js 22 on Red Hat Enterprise Linux 9 and could allow attackers to bypass filesystem permissions, cause denial of service, or expose uninitialized memory, potentially leading to unauthorized access or service disruption. The advisory rates the impact as Important, indicating a high security risk if unpatched.

Red Hat has released updated Node.js 22 packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:2782 and the referenced article https://access.redhat.com/articles/11258. No indication of temporary fixes or workarounds is provided, so applying the official update is the recommended mitigation.