This advisory covers six security vulnerabilities in the Node.js 22 module on Red Hat Enterprise Linux 8, including CVE-2025-55130 and related CVEs. The vulnerabilities include filesystem permissions bypass (CVE-2025-55130, CVE-2025-55132), denial of service (CVE-2026-21637, CVE-2025-59465, CVE-2025-59466), and uninitialized memory exposure (CVE-2025-55131). Red Hat has issued an update rebasing Node.js 22 to the latest upstream release, which addresses these issues. The advisory rates the update as important and provides packages for multiple architectures and extended life cycle versions. No known exploits in the wild have been reported at this time.

The vulnerabilities could allow an attacker to bypass filesystem permissions, cause denial of service conditions, or expose uninitialized memory, potentially leading to information disclosure or service disruption. The impact is rated as high by Red Hat Product Security. These issues affect the Node.js runtime environment, which is widely used for network applications, thus potentially impacting applications relying on Node.js on affected Red Hat Enterprise Linux 8 systems.

Red Hat has released an official security update for the Node.js 22 module on Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the update as detailed in the Red Hat advisory (RHSA-2026:2421) and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided update packages.