RHSA-2025:8468: Important: nodejs:20 security update
Published Jun 3, 2025
·Updated
Important: nodejs:20 security update
Other sources
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
43 affected componentsFixes available
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux Server - AUS
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates
Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates
Red Hat Red Hat Enterprise Linux for x86_64
Red Hat Red Hat Enterprise Linux for IBM z Systems
Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Red Hat Enterprise Linux for ARM 64
Red Hat Red Hat Enterprise Linux for Power, little endian
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Update Support
redhat/nodejs<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-nodemon<3.0.1-1.module+el9.6.0+23146+be9976bd
3.0.1-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-packaging<2021.06-4.module+el9.6.0+23146+be9976bd
2021.06-4.module+el9.6.0+23146+be9976bd
redhat/nodejs-docs<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-nodemon<3.0.1-1.module+el9.6.0+23146+be9976bd
3.0.1-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-packaging<2021.06-4.module+el9.6.0+23146+be9976bd
2021.06-4.module+el9.6.0+23146+be9976bd
redhat/nodejs-packaging-bundler<2021.06-4.module+el9.6.0+23146+be9976bd
2021.06-4.module+el9.6.0+23146+be9976bd
redhat/nodejs<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-debuginfo<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-debugsource<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-devel<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-full-i18n<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/npm<10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
redhat/nodejs-debuginfo<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-debugsource<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-devel<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-full-i18n<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/npm<10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
redhat/nodejs<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-debuginfo<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-debugsource<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-devel<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/nodejs-full-i18n<20.19.2-1.module+el9.6.0+23146+be9976bd
20.19.2-1.module+el9.6.0+23146+be9976bd
redhat/npm<10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
redhat/nodejs<20.19.2-1.module+el9.6.0+23146+be9976bd.aa
20.19.2-1.module+el9.6.0+23146+be9976bd.aa
redhat/nodejs-debuginfo<20.19.2-1.module+el9.6.0+23146+be9976bd.aa
20.19.2-1.module+el9.6.0+23146+be9976bd.aa
redhat/nodejs-debugsource<20.19.2-1.module+el9.6.0+23146+be9976bd.aa
20.19.2-1.module+el9.6.0+23146+be9976bd.aa
redhat/nodejs-devel<20.19.2-1.module+el9.6.0+23146+be9976bd.aa
20.19.2-1.module+el9.6.0+23146+be9976bd.aa
redhat/nodejs-full-i18n<20.19.2-1.module+el9.6.0+23146+be9976bd.aa
20.19.2-1.module+el9.6.0+23146+be9976bd.aa
redhat/npm<10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.aa
10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.aa
Remediation
Event History
Jun 3, 2025
Advisory Published
via Red Hat·07:23 PM
Nov 22, 2025
Advisory Published
via Red Hat·10:10 AM
Data Sourced
via Red Hat·10:10 AM
RemedyDescriptionAffected Software
Frequently Asked Questions
1
What is the severity of RHSA-2025:8468?
The severity of RHSA-2025:8468 is classified as Important.
2
How do I fix RHSA-2025:8468?
To fix RHSA-2025:8468, update your Node.js package to version 20.19.2-1.module+el9.6.0+23146+be9976bd.
3
What vulnerability does RHSA-2025:8468 address?
RHSA-2025:8468 addresses a remote crash vulnerability via SignTraits::DeriveBits() in Node.js, identified as CVE-2025-23166.
4
Which systems are affected by RHSA-2025:8468?
RHSA-2025:8468 affects multiple Red Hat Enterprise Linux flavors including x86_64, Power LE, and ARM.
5
Is it mandatory to apply the fix for RHSA-2025:8468?
Yes, applying the fix for RHSA-2025:8468 is necessary to mitigate the potential security risks associated with the vulnerability.