Red Hat Product Security released an important security update for the Node.js 22 module on Red Hat Enterprise Linux 8 addressing two vulnerabilities: a use-after-free in the c-ares library's read_answers() function (CVE-2025-31498) and an integer overflow in SQLite (CVE-2025-3277). These issues could potentially lead to memory corruption or other impacts associated with these classes of vulnerabilities (CWE-416 and CWE-122). The update rebases Node.js 22 to the latest upstream release containing these fixes. The advisory does not provide a CVSS score but rates the impact as important (high). The update is available for multiple architectures and Red Hat Enterprise Linux 8 variants. No exploits are currently known in the wild.

The vulnerabilities include a use-after-free in c-ares and an integer overflow in SQLite, both components used by Node.js. These could lead to memory corruption issues, potentially allowing attackers to cause crashes or execute arbitrary code depending on the context. Red Hat rates the security impact as important (high severity). No known exploits are reported at this time.

Red Hat has released an updated Node.js 22 module package for Red Hat Enterprise Linux 8 that includes fixes for these vulnerabilities. Users should apply the update as described in the Red Hat advisory (RHSA-2025:4459) and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix from Red Hat, applying the update is the recommended mitigation. No additional vendor mitigation instructions or temporary workarounds are provided.