Skip to content
OpenAdvisories
High RHSA-2025:7537 1 CVE

Red Hat Security Advisory: nodejs:20 security update

Published May 14, 2025 · Updated Sep 9, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs 1:20.18.2-2.module+el9.4.0+23089+aaa18a20
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-debuginfo 1:20.18.2-2.module+el9.4.0+23089+aaa18a20
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-debugsource 1:20.18.2-2.module+el9.4.0+23089+aaa18a20
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-devel 1:20.18.2-2.module+el9.4.0+23089+aaa18a20
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-docs 1:20.18.2-2.module+el9.4.0+23089+aaa18a20
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-full-i18n 1:20.18.2-2.module+el9.4.0+23089+aaa18a20
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-nodemon 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-packaging 0:2021.06-4.module+el9.3.0+19518+63aad52d
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream nodejs-packaging-bundler 0:2021.06-4.module+el9.3.0+19518+63aad52d
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream npm 1:10.8.2-1.20.18.2.2.module+el9.4.0+23089+aaa18a20

Vulnerabilities 1

  • High 8.3
    CVE-2025-31498

    c-ares has a use-after-free in read_answers()

    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or …

    c-ares c-ares fluent-bit c-ares Debian Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2358271
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7537.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-31498
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-31498
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-31498
  • article
    https://github.com/c-ares/c-ares/commit/29d38719112639d8c0ba910254a3dd4f482ea2d1
  • article
    https://github.com/c-ares/c-ares/pull/821
  • article
    https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v