RHSA-2025:8506: Important: nodejs:22 security update
Published Jun 4, 2025
·Updated
Important: nodejs:22 security update
Other sources
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. <br>Security Fix(es):<br><li> nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
46 affected componentsFixes available
Red Hat Red Hat Enterprise Linux for x86_64
Red Hat Red Hat Enterprise Linux for Power, little endian
Red Hat Red Hat Enterprise Linux for IBM z Systems
Red Hat Red Hat Enterprise Linux for ARM 64
redhat/nodejs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-nodemon<3.0.1-1.module+el8.10.0+23140+4056b950
3.0.1-1.module+el8.10.0+23140+4056b950
redhat/nodejs-packaging<2021.06-4.module+el8.10.0+23140+4056b950
2021.06-4.module+el8.10.0+23140+4056b950
redhat/nodejs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-debugsource<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-devel<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-docs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-full-i18n<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-libs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-libs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-nodemon<3.0.1-1.module+el8.10.0+23140+4056b950
3.0.1-1.module+el8.10.0+23140+4056b950
redhat/nodejs-packaging<2021.06-4.module+el8.10.0+23140+4056b950
2021.06-4.module+el8.10.0+23140+4056b950
redhat/nodejs-packaging-bundler<2021.06-4.module+el8.10.0+23140+4056b950
2021.06-4.module+el8.10.0+23140+4056b950
redhat/npm<10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950
10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950
redhat/v8<12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950
12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950
redhat/nodejs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-debugsource<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-devel<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-full-i18n<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-libs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-libs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/npm<10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950
10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950
redhat/v8<12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950
12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950
redhat/nodejs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-debugsource<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-devel<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-full-i18n<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-libs<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/nodejs-libs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950
22.16.0-1.module+el8.10.0+23140+4056b950
redhat/npm<10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950
10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950
redhat/v8<12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950
12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950
redhat/nodejs<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/nodejs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/nodejs-debugsource<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/nodejs-devel<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/nodejs-full-i18n<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/nodejs-libs<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/nodejs-libs-debuginfo<22.16.0-1.module+el8.10.0+23140+4056b950.aa
22.16.0-1.module+el8.10.0+23140+4056b950.aa
redhat/npm<10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950.aa
10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950.aa
redhat/v8<12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950.aa
12.4-devel-12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950.aa
Remediation
Event History
Jun 4, 2025
Advisory Published
via Red Hat·10:47 AM
Jul 18, 2025
Advisory Published
via Red Hat·10:59 AM
Data Sourced
via Red Hat·10:59 AM
RemedyDescriptionAffected Software
Frequently Asked Questions
1
What is the severity of RHSA-2025:8506?
The severity of RHSA-2025:8506 is classified as Important.
2
What vulnerabilities does RHSA-2025:8506 address?
RHSA-2025:8506 addresses a remote crash vulnerability via SignTraits::DeriveBits() in Node.js (CVE-2025-23166).
3
How do I fix the vulnerabilities in RHSA-2025:8506?
To fix the vulnerabilities in RHSA-2025:8506, update Node.js and related packages to version 22.16.0-1.module+el8.10.0+23140+4056b950.
4
Which versions of Node.js are affected by RHSA-2025:8506?
Node.js versions prior to 22.16.0-1.module+el8.10.0+23140+4056b950 are affected by RHSA-2025:8506.
5
Can I find detailed information about the issues in RHSA-2025:8506?
Yes, detailed information about the issues in RHSA-2025:8506 can be found in the associated advisory and bug tracking.