This advisory covers multiple security vulnerabilities in Node.js 22 as distributed by Red Hat for Red Hat Enterprise Linux 10. The issues include filesystem permissions bypass (CVE-2025-55130, CVE-2025-55132), denial of service (CVE-2025-59465, CVE-2025-59466, CVE-2026-21637), and uninitialized memory exposure (CVE-2025-55131). These vulnerabilities could allow unauthorized access to filesystem permissions, cause denial of service conditions, or expose uninitialized memory. Red Hat has released updated nodejs22 packages (version 22.22.0-3.el10_1) to address these vulnerabilities. The advisory does not provide CVSS scores but rates the impact as important/high severity.

The vulnerabilities impact Node.js installations on Red Hat Enterprise Linux 10, potentially allowing attackers to bypass filesystem permissions, cause denial of service, or access uninitialized memory. This could lead to unauthorized access or disruption of services running Node.js applications. The severity is rated as high by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Red Hat has released updated nodejs22 packages (version 22.22.0-3.el10_1) that fix these vulnerabilities. Users should apply these official updates as described in Red Hat advisory RHSA-2026:1843 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.