Skip to content
OpenAdvisories
Medium ELSA-2025-4461 1 CVE

Moderate: nodejs:20 security update (Oracle Linux 8)

Published May 5, 2025 · Updated May 5, 2025

Ecosystem: Oracle Linux

Summary

nodejs
[1:20.19.1-1]
- Update to version 20.19.1
Resolves: RHEL-78763

[1:20.18.2-4]
- Update c-ares to 1.34.5 to address CVE-2025-31498

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 8 nodejs 1:20.19.1-1.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 nodejs-devel 1:20.19.1-1.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 nodejs-docs 1:20.19.1-1.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 nodejs-full-i18n 1:20.19.1-1.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 nodejs-nodemon 0:3.0.1-1.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 nodejs-packaging 0:2021.06-4.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 nodejs-packaging-bundler 0:2021.06-4.module+el8.10.0+90560+49d7a1eb
Oracle Linux · 8 npm 1:10.8.2-1.20.19.1.1.module+el8.10.0+90560+49d7a1eb

Vulnerabilities 1

  • High 8.3
    CVE-2025-31498

    c-ares has a use-after-free in read_answers()

    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or …

    c-ares c-ares fluent-bit c-ares Debian Azure Linux Alpine