Critical Security Update for Node.js: Addressing Use-After-Free and Integer Overflow Vulnerabilities
Summary
ALSA-2025:7433: Important: nodejs:22 security update. Affects nodejs versions < 1:22.15.0-1.module_el9.6.0+164+2d89b8ed. Fixed in 1:22.15.0-1.module_el9.6.0+164+2d89b8ed. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful open-source platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development due to its non-blocking I/O model and event-driven architecture, which allows for efficient handling of multiple connections simultaneously. However, like any software, Node.js is susceptible to vulnerabilities that can compromise its security and functionality.
Vulnerability Detail
The recent security update for Node.js addresses two critical vulnerabilities: a use-after-free issue in the c-ares library's read_answers() function (CVE-2025-31498) and an integer overflow in SQLite (CVE-2025-3277). The use-after-free vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code. The integer overflow in SQLite may result in unexpected behavior or crashes, posing risks to data integrity and application stability.
How To Fix
Minimum fixed version
1:22.15.0-1.module_el9.6.0+164+2d89b8ed
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing strict input validation and sanitization in your application to mitigate potential exploitation of these vulnerabilities until the updates can be performed.
Conclusion
In summary, the recent security update for Node.js addresses critical vulnerabilities that could compromise application security. It is crucial to update to the latest patched versions of Node.js and its related packages to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for nodejs →
FAQ
The update addresses a use-after-free vulnerability in c-ares (CVE-2025-31498) and an integer overflow in SQLite (CVE-2025-3277).
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Failure to update may leave your application vulnerable to exploitation, leading to memory corruption, arbitrary code execution, or data integrity issues.
Yes, ensure you update to at least version 1:22.15.0-1.module_el9.6.0+164+2d89b8ed for Node.js and its related packages.
While you can continue using your application, it is recommended to implement strict input validation and sanitization as a temporary measure until the vulnerabilities are patched.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
