# CVE-2022-4904: nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...

CVE-2022-4904 is fixed in 18 products on 1 platform, first by libc-ares2 1.14.0-1ubuntu0.2, released February 14, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-4904
- Priority: High
- CVSS: 8.6 (Important)
- EPSS: 0.0123
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 14, 2023

## Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   Security Fix(es):  * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)  * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)  * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)  * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)  * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | c-ares Debian 12.15 (bookworm) | 1.18.1-2 | [DEBIAN-CVE-2022-4904](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4904.md) | Mar 6, 2023 |
| Linux | c-ares Debian 13.5 (trixie) | 1.18.1-2 | [DEBIAN-CVE-2022-4904](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4904.md) | Mar 6, 2023 |
| Linux | c-ares Debian 14 | 1.18.1-2 | [DEBIAN-CVE-2022-4904](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4904.md) | Mar 6, 2023 |
| Linux | c-ares RHEL 8 | 0:1.13.0-8.el8 | [RHSA-2023:7116](https://patchblox.com/security/data/fix/linux/rhsa-2023-7116.md) | Nov 14, 2023 |
| Linux | c-ares RHEL 9 | 0:1.19.1-1.el9 | [RHSA-2023:6635](https://patchblox.com/security/data/fix/linux/rhsa-2023-6635.md) | Nov 7, 2023 |
| Linux | c-ares almalinux 8 | 1.13.0-8.el8 | [ALSA-2023:7116](https://patchblox.com/security/data/fix/linux/alsa-2023-7116.md) | Nov 14, 2023 |
| Linux | c-ares almalinux 9 | 1.19.1-1.el9 | [ALSA-2023:6635](https://patchblox.com/security/data/fix/linux/alsa-2023-6635.md) | Nov 7, 2023 |
| Linux | c-ares amzn 2023 | 1.19.0-1.amzn2023 | [ALAS2023-2023-198](https://patchblox.com/security/data/fix/linux/alas2023-2023-198.md) | Jun 5, 2023 |
| Linux | c-ares ol 8 | 0:1.13.0-8.el8 | [ELSA-2023-7116](https://patchblox.com/security/data/fix/linux/elsa-2023-7116.md) | Nov 17, 2023 |
| Linux | c-ares ol 9 | 0:1.19.1-1.el9 | [ELSA-2023-6635](https://patchblox.com/security/data/fix/linux/elsa-2023-6635.md) | Nov 11, 2023 |
| Linux | c-ares-debuginfo amzn 2023 | 1.19.0-1.amzn2023 | [ALAS2023-2023-198](https://patchblox.com/security/data/fix/linux/alas2023-2023-198.md) | Jun 5, 2023 |
| Linux | c-ares-debugsource amzn 2023 | 1.19.0-1.amzn2023 | [ALAS2023-2023-198](https://patchblox.com/security/data/fix/linux/alas2023-2023-198.md) | Jun 5, 2023 |
| Linux | c-ares-devel RHEL 8 | 0:1.13.0-8.el8 | [RHSA-2023:7116](https://patchblox.com/security/data/fix/linux/rhsa-2023-7116.md) | Nov 14, 2023 |
| Linux | c-ares-devel RHEL 9 | 0:1.19.1-1.el9 | [RHSA-2023:6635](https://patchblox.com/security/data/fix/linux/rhsa-2023-6635.md) | Nov 7, 2023 |
| Linux | c-ares-devel almalinux 8 | 1.13.0-8.el8 | [ALSA-2023:7116](https://patchblox.com/security/data/fix/linux/alsa-2023-7116.md) | Nov 14, 2023 |
| Linux | c-ares-devel almalinux 9 | 1.19.1-1.el9 | [ALSA-2023:6635](https://patchblox.com/security/data/fix/linux/alsa-2023-6635.md) | Nov 7, 2023 |
| Linux | c-ares-devel amzn 2023 | 1.19.0-1.amzn2023 | [ALAS2023-2023-198](https://patchblox.com/security/data/fix/linux/alas2023-2023-198.md) | Jun 5, 2023 |
| Linux | c-ares-devel ol 8 | 0:1.13.0-8.el8 | [ELSA-2023-7116](https://patchblox.com/security/data/fix/linux/elsa-2023-7116.md) | Nov 17, 2023 |
| Linux | c-ares-devel ol 9 | 0:1.19.1-1.el9 | [ELSA-2023-6635](https://patchblox.com/security/data/fix/linux/elsa-2023-6635.md) | Nov 11, 2023 |
| Linux | libc-ares2 Ubuntu 18.04.6 LTS (bionic) | 1.14.0-1ubuntu0.2 | [libc-ares2 1.14.0-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libc-ares2-1.14.0-1ubuntu0.2.md) | Feb 14, 2023 |
| Linux | libc-ares2 Ubuntu 20.04 LTS (focal) | 1.15.0-1ubuntu0.2 | [libc-ares2 1.15.0-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libc-ares2-1.15.0-1ubuntu0.2.md) | Feb 14, 2023 |
| Linux | libc-ares2 Ubuntu 22.04.1 LTS (jammy) | 1.18.1-1ubuntu0.22.04.1 | [libc-ares2 1.18.1-1ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libc-ares2-1.18.1-1ubuntu0.22.04.1.md) | Feb 14, 2023 |
| Linux | nodejs RHEL 8 | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs almalinux 8 | 1:18.14.2-3.module_el8.8.0+3587+ee652244 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs rocky 8 | 1:18.14.2-3.module+el8.8.0+1337+7ea46b57 | [RLSA-2023:4035](https://patchblox.com/security/data/fix/linux/rlsa-2023-4035.md) | Aug 31, 2023 |
| Linux | nodejs rocky 9 | 1:16.19.1-1.el9_2 | [RLSA-2023:2655](https://patchblox.com/security/data/fix/linux/rlsa-2023-2655.md) | May 25, 2023 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-devel RHEL 9 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-devel almalinux 8 | 1:18.14.2-3.module_el8.8.0+3587+ee652244 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-devel almalinux 9 | 1:18.14.2-2.module_el9.2.0+29+de583a0b | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-devel ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-docs RHEL 8 | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-docs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-docs almalinux 8 | 1:18.14.2-3.module_el8.8.0+3587+ee652244 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-docs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-docs ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-full-i18n RHEL 8 | 1:18.14.2-3.module+el8.8.0+19021+4b8b11cc | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-full-i18n RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-full-i18n almalinux 8 | 1:18.14.2-3.module_el8.8.0+3587+ee652244 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-full-i18n almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-libs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-libs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-libs ol 9 | 1:16.19.1-1.el9_2 | [ELSA-2023-2655](https://patchblox.com/security/data/fix/linux/elsa-2023-2655.md) | May 17, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-2.module+el8.8.0+18432+27f188ac | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-nodemon RHEL 9 | 0:2.0.20-3.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-2.module_el8.8.0+3587+ee652244 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-nodemon almalinux 9 | 2.0.20-2.module_el9.2.0+29+de583a0b | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-3.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon ol 9 | 0:2.0.20-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-2.module+el8.7.0+1177+510ae886 | [RLSA-2023:4035](https://patchblox.com/security/data/fix/linux/rlsa-2023-4035.md) | Aug 31, 2023 |
| Linux | nodejs-nodemon rocky 9 | 0:2.0.20-3.el9_2 | [RLSA-2023:2655](https://patchblox.com/security/data/fix/linux/rlsa-2023-2655.md) | May 25, 2023 |
| Linux | nodejs-packaging RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-packaging RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-packaging almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging ol 8 | 0:23-3.module+el8.3.0+7818+6cd30d85 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-packaging rocky 8 | 0:2021.06-4.module+el8.7.0+1072+5b168780 | [RLSA-2023:4035](https://patchblox.com/security/data/fix/linux/rlsa-2023-4035.md) | Aug 31, 2023 |
| Linux | nodejs-packaging rocky 9 | 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2 | [RLSA-2023:2654](https://patchblox.com/security/data/fix/linux/rlsa-2023-2654.md) | Dec 3, 2025 |
| Linux | nodejs-packaging-bundler RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-packaging-bundler RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging-bundler almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | nodejs-packaging-bundler almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging-bundler ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-4035](https://patchblox.com/security/data/fix/linux/elsa-2023-4035.md) | Jul 19, 2023 |
| Linux | nodejs-packaging-bundler ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | npm RHEL 8 | 1:9.5.0-1.18.14.2.3.module+el8.8.0+19021+4b8b11cc | [RHSA-2023:4035](https://patchblox.com/security/data/fix/linux/rhsa-2023-4035.md) | Jul 12, 2023 |
| Linux | npm RHEL 9 | 1:8.19.3-1.16.19.1.1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | npm almalinux 8 | 1:9.5.0-1.18.14.2.3.module_el8.8.0+3587+ee652244 | [ALSA-2023:4035](https://patchblox.com/security/data/fix/linux/alsa-2023-4035.md) | Jul 12, 2023 |
| Linux | npm almalinux 9 | 1:8.19.3-1.16.19.1.1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | npm ol 8 | 1:6.14.18-1.14.21.3.1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm ol 9 | 1:9.5.0-1.18.14.2.2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.