Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:1611: Important: nodejs:22 security update. Affects nodejs versions < 1:22.13.1-1.module_el8.10.0+3961+6a788e57. Fixed in 1:22.13.1-1.module_el8.10.0+3961+6a788e57. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers features such as non-blocking I/O and an extensive library of modules. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js stem from issues in its underlying libraries and components. Notably, the 'undici' library has been found to use insufficiently random values (CVE-2025-22150), which could lead to predictable outcomes in certain operations. Additionally, a security flaw (CVE-2025-23083) exposes Node.js worker threads via the diagnostics channel, allowing unauthorized access to sensitive information. Another critical issue (CVE-2025-23085) involves a memory leak caused by GOAWAY HTTP/2 frames, which can degrade application performance over time. These vulnerabilities can lead to data leaks, unauthorized access, and overall instability in applications.
How To Fix
Minimum fixed version
1:22.13.1-1.module_el8.10.0+3961+6a788e57
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the exposure of worker threads and disabling features that utilize the diagnostics channel until the update can be applied. Additionally, monitor application performance closely to identify any signs of memory leaks.
Conclusion
In summary, the identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is crucial to update to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can enhance your ability to monitor and respond to vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities can lead to unauthorized access, data leaks, and performance degradation in applications built on Node.js.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement workarounds such as limiting the use of worker threads and monitoring for performance issues.
Regularly check for updates and security advisories for Node.js and its dependencies to ensure your application remains secure.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities, helping you maintain the security of your applications without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
