Red Hat has issued a security update for the nodejs:22 module in Red Hat Enterprise Linux 9 to address two vulnerabilities: a use-after-free in the c-ares library's read_answers() function (CVE-2025-31498) and an integer overflow in SQLite (CVE-2025-3277). These vulnerabilities could potentially lead to memory corruption issues. The update is classified as important by Red Hat and affects multiple architectures and extended update support versions of Red Hat Enterprise Linux 9. The advisory references Red Hat's official errata RHSA-2025:7433 and provides links for applying the update.

The vulnerabilities involve memory corruption issues—a use-after-free and an integer overflow—which can lead to instability or potentially allow an attacker to execute arbitrary code or cause denial of service. Red Hat rates the security impact as important (high severity). There are no known exploits in the wild at the time of the advisory. The vulnerabilities affect Node.js as packaged in Red Hat Enterprise Linux 9 across various supported architectures and update streams.

Red Hat has released an official security update for the nodejs:22 module in Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as detailed in Red Hat advisory RHSA-2025:7433 and the referenced article https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.