Security Update for Node.js: Addressing Memory Leak and Random Value Vulnerabilities
Summary
ALSA-2025:1582: Moderate: nodejs:18 security update. Affects nodejs versions < 1:18.20.6-1.module_el8.10.0+3960+fcfbf683. Fixed in 1:18.20.6-1.module_el8.10.0+3960+fcfbf683. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could potentially compromise the security and performance of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js include CVE-2025-22150, where the 'undici' library uses insufficiently random values, potentially leading to predictable outcomes in cryptographic operations. Additionally, CVE-2025-23085 highlights a memory leak issue caused by GOAWAY HTTP/2 frames, which can lead to increased memory consumption and degraded application performance. These vulnerabilities can be exploited by attackers to affect the stability and security of applications.
How To Fix
Minimum fixed version
1:18.20.6-1.module_el8.10.0+3960+fcfbf683
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate patching is not feasible, consider limiting the exposure of your Node.js applications by implementing network security measures, such as firewalls and access controls, to mitigate potential exploitation of these vulnerabilities until a proper update can be applied.
Conclusion
In summary, Node.js has identified vulnerabilities that require immediate attention to ensure the security and performance of applications. By updating to the latest patched versions of the affected packages, developers can protect their applications from potential exploitation. Utilizing tools like Vulert can further enhance security monitoring.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities are related to insufficiently random values in the 'undici' library and a memory leak issue caused by GOAWAY HTTP/2 frames.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
These vulnerabilities can lead to predictable outcomes in cryptographic operations and increased memory consumption, potentially affecting application performance and security.
It is advisable to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
If immediate updates are not possible, implement network security measures to limit exposure and mitigate risks until you can apply the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
