Skip to content
OpenAdvisories
High ALAS2023-2026-1981 1 CVE

Important: nodejs22 security update (Amazon Linux 2023)

Published Jul 20, 2026 · Updated Jul 20, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33630: A use-after-free / double-free in c-ares' query-completion handling. The same flaw -- a query's callback being invoked while the query is still linked in the channel's internal lookup structures -- is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for `ares_getaddrinfo()` the owning `host_query`, is freed as a side effect of that callback, it is then accessed and/or freed a second time.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs22 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-debuginfo 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-debugsource 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-devel 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-docs 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-full-i18n 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-libs 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-libs-debuginfo 1:22.23.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-npm 1:10.9.8-1.22.23.1.1.amzn2023.0.2
Amazon Linux · 2023 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.amzn2023.0.2

Vulnerabilities 1

  • High 7.5

    c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP

    c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup st…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-33630.html