Skip to content
OpenAdvisories
Medium ALAS2023-2025-1347 1 CVE

Moderate: nodejs22 security update (Amazon Linux 2023)

Published Jan 7, 2026 · Updated Jan 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs22 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-debuginfo 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-debugsource 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-devel 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-docs 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-full-i18n 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-libs 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-libs-debuginfo 1:22.21.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-npm 1:10.9.4-1.22.21.1.1.amzn2023.0.2
Amazon Linux · 2023 v8-12.4-devel 3:12.4.254.21-1.22.21.1.1.amzn2023.0.2

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-62408

    c-ares has a Use After Free vulnerability when connection is cleaned up after error

    c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-62408.html