Skip to content
OpenAdvisories
Medium ALAS2023-2025-1348 1 CVE

Moderate: nodejs24 security update (Amazon Linux 2023)

Published Jan 7, 2026 · Updated Jan 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62408: Use after free due to connection being cleaned up after error

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs24 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-debuginfo 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-debugsource 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-devel 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-docs 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-full-i18n 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-libs 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-libs-debuginfo 1:24.11.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-npm 1:11.6.2-1.24.11.1.1.amzn2023.0.2
Amazon Linux · 2023 v8-13.6-devel 3:13.6.233.10-1.24.11.1.1.amzn2023.0.2

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-62408

    c-ares has a Use After Free vulnerability when connection is cleaned up after error

    c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-62408.html