Threat Intelligence Database

Multiple security vulnerabilities affecting Node.js 18 and related components in Red Hat Enterprise Linux 9 have been addressed in an important security update. The issues include denial of service (DoS) vulnerabilities via CONTINUATION frames and the fetch() function, HTTP request smuggling via content length obfuscation, and an out-of-bounds read in the c-ares library. These vulnerabilities could lead to service disruption or crashes. Red Hat has released updates to fix these issues for various Red Hat Enterprise Linux 9 variants and architectures.

Red Hat has issued a security advisory for Node.js addressing two vulnerabilities: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982) and a Denial of Service (DoS) vulnerability via CONTINUATION frames (CVE-2024-27983). These issues affect Node.js as packaged for Red Hat Enterprise Linux 9. The advisory rates the impact as Important and provides updated packages to remediate these vulnerabilities.

A moderate security advisory from Red Hat addresses multiple vulnerabilities affecting Node.js and related components. The primary issue (CVE-2024-22025) involves the use of the fetch() function to retrieve content from untrusted URLs, which can lead to denial of service. Additional vulnerabilities include a denial of service in nghttp2 (CVE-2024-28182) and an out-of-bounds read in c-ares (CVE-2024-25629). Red Hat has released updates for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions to remediate these issues.

A security vulnerability (CVE-2025-23083) affecting Node.js 20 has been identified and addressed by Red Hat. The issue involves exposure of Node.js Worker Threads via the Diagnostics Channel. Red Hat has released an important security update for Node.js 20 on Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory provides updated packages to remediate this vulnerability.

A security update for Node.js 20 on Red Hat Enterprise Linux addresses multiple vulnerabilities, including a remote crash issue via SignTraits::DeriveBits() (CVE-2025-23166). The update is rated as important by Red Hat Product Security. The advisory covers Red Hat Enterprise Linux 9 and its extended update support versions across multiple architectures. No CVSS score is provided in the advisory. The vulnerabilities relate to issues such as resource management and potential crashes.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A security update for Node.js 20 on Red Hat Enterprise Linux 9.6 addresses multiple vulnerabilities including denial of service, uninitialized memory exposure, and file permissions bypass. These issues affect the Node.js platform used for building scalable network applications in JavaScript. The update is rated as important by Red Hat Product Security and applies to various Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. No CVSS score is provided, but the severity is assessed as high. The advisory references multiple CVEs including CVE-2025-55130, CVE-2025-55131, and CVE-2025-59465 among others. Red Hat provides updated packages and instructions for remediation.

A security update for Node.js 20 on Red Hat Enterprise Linux 9.4 addresses multiple vulnerabilities including denial of service, uninitialized memory exposure, and file permissions bypass. These issues could impact the security of applications running Node.js on affected Red Hat platforms. The update is rated as important by Red Hat Product Security and fixes several CVEs. Users of the affected Red Hat Enterprise Linux 9.4 Extended Update Support versions should apply the update to mitigate these vulnerabilities.