CVE-2025-31498

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

• SQLite: integer overflow in SQLite (CVE-2025-3277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

• SQLite: integer overflow in SQLite (CVE-2025-3277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)
• SQLite: integer overflow in SQLite (CVE-2025-3277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)
• SQLite: integer overflow in SQLite (CVE-2025-3277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

• c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

These are all security issues fixed in the c-ares-devel-1.34.5-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-31498 in the c-ares package for Root:Alpine:3.20. Multiple fixed versions available.

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

Update to c-ares 1.34.8.

• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: use-after-free due to connection being cleaned up after error (bsc#1254738).
• CVE-2026-33630: remotely triggerable use-after-free/double-free in query-completion handling via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: memory amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• c-ares 1.34.8:
  • For details, see https://c-ares.org/changelog.html.
• c-ares 1.34.6:
  • Ignore Windows IDN Search Domains until proper IDN support is added.
  • Various bug fixes.
• c-ares 1.34.4:
  • Changes:
    • QNX Port: Port to QNX 8, add primary config reading support, add CI build. PR #934, PR #937, PR #938
  • Bugfixes:
    • Empty TXT records were not being preserved. PR #922
    • docs: update deprecation notices for ares_create_query() and ares_mkquery(). PR #910
    • license: some files weren't properly updated. PR #920
    • Fix bind local device regression from 1.34.0. PR #929, PR #931, PR #935
    • CMake: set policy version to prevent deprecation warnings. PR #932
    • CMake: shared and static library names should be the same on unix platforms like autotools uses. PR #933
    • Update to latest autoconf archive macros for enhanced system compatibility. PR #936
• c-ares 1.34.3:
  • Build the release package in an automated way so we can provide provenance as per SLSA3. PR #906
  • Some upstream servers are non-compliant with EDNS options, resend queries without EDNS. Issue #911
  • TSAN warns on missing lock, but lock isn't actually necessary. PR #915
  • ares_getaddrinfo() for AF_UNSPEC should retry IPv4 if only IPv6 is received. 765d558
  • ares_send() shouldn't return ARES_EBADRESP, its ARES_EBADQUERY. 91519e7
  • Fix typos in man pages. PR #905
• c-ares 1.34.2:
  • Features:
    • adig: read arguments from adigrc. [PR #856]
    • Add new pending write callback optimization via ares_set_pending_write_cb. [PR #857]
    • New function ares_process_fds(). [PR #875]
    • Failed servers should be probed rather than redirecting queries which could cause unexpected latency. [PR #877]
    • adig: rework command line arguments to mimic dig from bind. [PR #890]
    • Add new method for overriding network functions ares_set_socket_function_ex() to properly support all new functionality. [PR #894]
    • Fix regression with custom socket callbacks due to DNS cookie support. [PR #895]
    • ares_socket: set IP_BIND_ADDRESS_NO_PORT on ares_set_local_ip* tcp sockets [PR #887]
    • URI parser/writer for ares_set_servers_csv()/ares_get_servers_csv(). [PR #882]
    • Connection handling modularization. [PR #857], [PR #876]
    • Expose library/utility functions to tools. [PR #860]
    • Remove ares__ prefix, just use ares_ for internal functions. [PR #872]
    • fix: potential WIN32_LEAN_AND_MEAN redefinition. [PR #869]
    • Fix googletest v1.15 compatibility. [PR #874]
    • Fix pkgconfig thread dependencies. [PR #884]
• c-ares 1.33.0:
  • Add DNS cookie support (RFC7873 + RFC9018) to help prevent off-path cache poisoning attacks. [PR #833]
  • Implement TCP FastOpen (TFO) RFC7413, which will make TCP reconnects 0-RTT on supported systems. [PR #840]
  • Reorganize source tree. [PR #822]
  • Refactoring of connection handling to prevent code duplication. [PR #839]
  • New dynamic array data structure to prevent simple logic flaws in array handling in various code paths. [PR #841]
  • ares_destroy() race condition during shutdown due to missing lock. [PR #831]
• c-ares in 1.32:
  • Add support for DNS 0x20 to help prevent cache poisoning attacks, enabled by specifying…

This update for c-ares fixes the following issues:

• CVE-2024-25629: out of bounds read in ares__read_line() (bsc#1220279).
• CVE-2025-31498: use-after-free in read_answers() when process_answer() may re-enqueue a query (bsc#1240955).
• CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
• CVE-2026-33630: Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP (bsc#1270416).
• CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (bsc#1276290).
• CVE-2026-69186: Memory-amplification denial of service via unvalidated DNS header record counts (bsc#1276291).

Changes for c-ares:

• updated to 1.36.8.

It was discovered that c-ares incorrectly handled re-enqueuing certain queries. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service.