c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause aresdnsrecordrrprealloc() and aresarraysetsize() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7.

Updates are now available for the 25.x, 24.x, 22.x, and 20.x Node.js release lines to address:

3 high severity issues.

4 medium severity issues.

1 low severity issue.

This security release includes the following dependency updates to address public vulnerabilities:

c-ares (1.34.6) on 20.x, 22.x, 24.x, 25.x

undici (6.23.0, 7.18.0) on 20.x, 22.x, 24.x, 25.x

CVE-2025-31498

Impact

Patches

Versions 1.32.3 - 1.34.4 are affected. Patch in 1.34.5.

Workarounds

None

References https://github.com/c-ares/c-ares/releases/tag/v1.34.5

Credit

Reported by Erik Lax

A possible use-after-free and double-free in c-ares lib version 1.16.0 if aresdestroy() is called prior to aresgetaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.