Skip to content
OpenAdvisories
Medium ALAS2023-2025-1346 1 CVE

Moderate: nodejs20 security update (Amazon Linux 2023)

Published Jan 7, 2026 · Updated Jan 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs20 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-debuginfo 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-debugsource 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-devel 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-docs 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-full-i18n 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-libs 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-libs-debuginfo 1:20.19.5-1.amzn2023.0.2
Amazon Linux · 2023 nodejs20-npm 1:10.8.2-1.20.19.5.1.amzn2023.0.2
Amazon Linux · 2023 v8-11.3-devel 3:11.3.244.8-1.20.19.5.1.amzn2023.0.2

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-62408

    c-ares has a Use After Free vulnerability when connection is cleaned up after error

    c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-62408.html