Threats Tagged 'cve-2025-23085'

This advisory addresses multiple security vulnerabilities in Node.js 20 as packaged by Red Hat for Red Hat Enterprise Linux 8. The issues include insufficient randomness in the undici HTTP client library (CVE-2025-22150), exposure of Node.js worker threads via the diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames (CVE-2025-23085). Red Hat has released an update to mitigate these vulnerabilities. The update is rated as having an Important security impact by Red Hat Product Security.

This advisory addresses multiple security vulnerabilities in Node.js 20 as packaged by Red Hat for Red Hat Enterprise Linux 9. The issues include insufficient randomness in the undici HTTP client library (CVE-2025-22150), exposure of Node.js worker threads via the diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames outside the heap (CVE-2025-23085). Red Hat has released an important security update to fix these vulnerabilities in their Node.js 20 module. The update is available for various Red Hat Enterprise Linux 9 variants and architectures. No known exploits in the wild have been reported at this time.

Red Hat issued a moderate severity security advisory for the nodejs:18 module addressing two vulnerabilities: CVE-2025-22150, where the undici HTTP client uses insufficiently random values, and CVE-2025-23085, where GOAWAY HTTP/2 frames cause a memory leak outside the heap. These issues affect Red Hat Enterprise Linux 8 variants. The advisory includes updated packages to fix these vulnerabilities.

This Red Hat security advisory addresses multiple vulnerabilities in the Node.js 22 module for Red Hat Enterprise Linux 8. The issues include insufficient randomness in the undici HTTP client library (CVE-2025-22150), exposure of Node.js worker threads via the diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames outside the heap (CVE-2025-23085). The update is rated as important by Red Hat and affects several architectures of Red Hat Enterprise Linux 8. A security update is available to fix these vulnerabilities.

Red Hat has issued a security advisory for nodejs:22 module addressing three vulnerabilities: insufficient randomness in undici (CVE-2025-22150), worker thread exposure via diagnostics channel (CVE-2025-23083), and a memory leak caused by GOAWAY HTTP/2 frames (CVE-2025-23085). These issues affect Node.js used in Red Hat Enterprise Linux 9 and related variants. The advisory rates the update as important and provides updated packages to remediate these vulnerabilities.