Open Source Vulnerability in nodejs-nodemon package
Summary
ALBA-2019:4275: nodejs:12 bug fix update. Affects nodejs-nodemon across 3 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.4.0+2224+b07ac28e
< 1.18.3-1.module_el8.5.0+81+7dbe79d3
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module_el8.4.0+2224+b07ac28e or 1.18.3-1.module_el8.5.0+81+7dbe79d3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nodejs-nodemon package is a tool that helps in automatically restarting the Node.js application whenever changes are made to the source code. It is widely used in development environments to improve productivity and streamline the development process.
Vulnerability Detail
The vulnerability in the nodejs-nodemon package allows an attacker to execute arbitrary code on the server running the Node.js application. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability originates from a bug in the package's code, which has been fixed in versions 1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module_el8.4.0+2224+b07ac28e, and 1.18.3-1.module_el8.5.0+81+7dbe79d3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.4.0+2224+b07ac28e1.18.3-1.module_el8.4.0+2224+b07ac28e -
< 1.18.3-1.module_el8.5.0+81+7dbe79d31.18.3-1.module_el8.5.0+81+7dbe79d3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating the package to the fixed versions is the only solution.
Conclusion
The vulnerability in the nodejs-nodemon package can have serious consequences if left unpatched. It is crucial to update the package to one of the fixed versions mentioned above to mitigate the risk of unauthorized access and data breaches. For further support and guidance, reach out to DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to unauthorized access and data breaches.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities.
There are currently no known exploits for this vulnerability. However, it is important to update the package as soon as possible to prevent any potential attacks.
No, manual patching is not recommended. It is best to update the package using the package manager command mentioned in the 'how_to_fix' section.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
