Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-47279: Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails. CVE-2025-23166: Improper error handling in async cryptographic operations crashes process Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-async-cryptographic-operations-crashes-process-cve-2025-23166---high CVE-2025-23165: Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs22 | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-debuginfo | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-debugsource | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-devel | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-docs | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-full-i18n | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-libs | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-libs-debuginfo | 1:22.16.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | nodejs22-npm | 1:10.9.2-1.22.16.0.1.amzn2023.0.1 |
| Amazon Linux · 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.16.0.1.amzn2023.0.1 |
Vulnerabilities 3
-
High 7.5
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when execut…
-
Low 3.7
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 pat…
-
Low 3.1
undici Denial of Service attack via bad certificate data
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the applicat…