Skip to content
OpenAdvisories
High ALAS2023-2025-1009 3 CVEs

Important: nodejs22 security update (Amazon Linux 2023)

Published Jun 4, 2025 · Updated Jun 10, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-47279: Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails. CVE-2025-23166: Improper error handling in async cryptographic operations crashes process Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-async-cryptographic-operations-crashes-process-cve-2025-23166---high CVE-2025-23165: Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs22 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-debuginfo 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-debugsource 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-devel 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-docs 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-full-i18n 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-libs 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-libs-debuginfo 1:22.16.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs22-npm 1:10.9.2-1.22.16.0.1.amzn2023.0.1
Amazon Linux · 2023 v8-12.4-devel 3:12.4.254.21-1.22.16.0.1.amzn2023.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-23165.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-23166.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-47279.html