Critical Security Update for Node.js Package: Red Hat Security Advisory RHSA-2025:11803
Summary
RHSA-2025:11803: Red Hat Security Advisory: nodejs:22 security update. Affects nodejs versions < 1:22.16.0-2.module+el8.10.0+23338+c5a38893. Fixed in 1:22.16.0-2.module+el8.10.0+23338+c5a38893. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, widely used for building scalable network applications. It allows developers to use JavaScript for server-side scripting, enabling full-stack development with a single language. The recent security advisory highlights vulnerabilities in various Node.js packages within the Red Hat Enterprise Linux 8 ecosystem, necessitating immediate attention from developers and system administrators.
Vulnerability Detail
The vulnerability identified in the Node.js packages stems from a flaw that could allow an attacker to exploit the system, potentially leading to unauthorized access or data breaches. The CVSS score of 7.7 indicates a high severity level, emphasizing the importance of addressing this issue promptly. The affected packages include nodejs, nodejs-debuginfo, nodejs-devel, and others, all of which are critical for running Node.js applications securely.
How To Fix
Minimum fixed version
1:22.16.0-2.module+el8.10.0+23338+c5a38893
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network security measures such as firewalls and intrusion detection systems to mitigate potential risks until the packages can be updated.
Conclusion
The recent security advisory RHSA-2025:11803 highlights critical vulnerabilities in Node.js packages within the Red Hat Enterprise Linux 8 ecosystem. It is crucial for developers and system administrators to update their packages to the patched versions to mitigate potential security risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
The affected packages include nodejs, nodejs-debuginfo, nodejs-devel, npm, and several others within the Red Hat Enterprise Linux 8 ecosystem.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing additional security measures such as firewalls and monitoring systems to protect your application.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2025:11803.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
