c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

alma_linux ALSA-2025:7433: ALSA-2025:7433: nodejs:22 security update (High)

redhat RHSA-2025:7433: RHSA-2025:7433: nodejs:22 security update (Important)

redhat RHSA-2025:7502: RHSA-2025:7502: nodejs22 security update (Moderate)

redhat RHSA-2025:7426: RHSA-2025:7426: nodejs:20 security update (Moderate)

FA plugin updates for vendor_unpatched: 2025/04/09 01:22 chunk 1/1

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0062 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-31498:
    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in     read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the     upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the     connection immediately after a response. If there was an issue trying to put that new transaction on the     wire, it would close the connection handle, but read_answers() was still expecting the connection handle     to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger     this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and     can return a result with one of those conditions, this has been untested. Otherwise only a local attacker     might be able to change system behavior to make send()/write() return a failure condition. This     vulnerability is fixed in 1.34.5.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7537 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3eb5235527 advisory.

    Update to version 22.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2c1f4c46d0 advisory.

    Update to version 22.15.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:4459 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)
      * SQLite: integer overflow in SQLite (CVE-2025-3277)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:4461 advisory.

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-88025e98b2 advisory.

    Update to version 20.19.1


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-4461 advisory.

    nodejs     [1:20.19.1-1]
    - Update to version 20.19.1       Resolves: RHEL-78763

    [1:20.18.2-4]
    - Update c-ares to 1.34.5 to address CVE-2025-31498

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-4459 advisory.

    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87300

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.10 / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7477-1 advisory.

    It was discovered that c-ares incorrectly handled re-enqueuing certain queries. A remote attacker could     possibly use this issue to cause c-ares to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4459 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4461 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-942 advisory.

    c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in     read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the     upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the     connection immediately after a response. If there was an issue trying to put that new transaction on the     wire, it would close the connection handle, but read_answers() was still expecting the connection handle     to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger     this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and     can return a result with one of those conditions, this has been untested. Otherwise only a local attacker     might be able to change system behavior to make send()/write() return a failure condition. This     vulnerability is fixed in 1.34.5. (CVE-2025-31498)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of c-ares installed on the remote host is affected by a use after free vulnerability. c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-942a0d7e5d advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c26ac54608 advisory.

    Update to 1.34.5. Fixes CVE-2025-31498.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in     read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the     upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the     connection immediately after a response. If there was an issue trying to put that new transaction on the     wire, it would close the connection handle, but read_answers() was still expecting the connection handle     to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger     this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and     can return a result with one of those conditions, this has been untested. Otherwise only a local attacker     might be able to change system behavior to make send()/write() return a failure condition. This     vulnerability is fixed in 1.34.5. (CVE-2025-31498)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
236940	Alibaba Cloud Linux 3 : 0062: nodejs:20 (ALINUX3-SA-2025:0062)	Nessus	Alibaba Cloud Linux Local Security Checks	high
235930	RHEL 9 : nodejs:20 (RHSA-2025:7537)	Nessus	Red Hat Local Security Checks	high
235689	Fedora 40 : nodejs22 (2025-3eb5235527)	Nessus	Fedora Local Security Checks	high
235685	Fedora 41 : nodejs22 (2025-2c1f4c46d0)	Nessus	Fedora Local Security Checks	high
235603	AlmaLinux 8 : nodejs:22 (ALSA-2025:4459)	Nessus	Alma Linux Local Security Checks	high
235600	AlmaLinux 8 : nodejs:20 (ALSA-2025:4461)	Nessus	Alma Linux Local Security Checks	high
235427	Fedora 41 : nodejs20 (2025-88025e98b2)	Nessus	Fedora Local Security Checks	high
235154	Oracle Linux 8 : nodejs:20 (ELSA-2025-4461)	Nessus	Oracle Linux Local Security Checks	high
235151	Oracle Linux 8 : nodejs:22 (ELSA-2025-4459)	Nessus	Oracle Linux Local Security Checks	high
235139	Ubuntu 24.10 / 25.04 : c-ares vulnerability (USN-7477-1)	Nessus	Ubuntu Local Security Checks	high
235135	RHEL 8 : nodejs:22 (RHSA-2025:4459)	Nessus	Red Hat Local Security Checks	high
235129	RHEL 8 : nodejs:20 (RHSA-2025:4461)	Nessus	Red Hat Local Security Checks	high
234936	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-942)	Nessus	Amazon Linux Local Security Checks	high
234803	c-ares 1.32.3 < 1.34.5 Use After Free (macOS)	Nessus	MacOS X Local Security Checks	high
234785	Fedora 40 : c-ares (2025-942a0d7e5d)	Nessus	Fedora Local Security Checks	high
234696	Fedora 41 : c-ares (2025-c26ac54608)	Nessus	Fedora Local Security Checks	high
234193	Linux Distros Unpatched Vulnerability : CVE-2025-31498	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-31498

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical