Vulnerability in nodejs-nodemon package
Summary
ALEA-2019:3461: new module: nodejs:12. Affects nodejs-nodemon across 3 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.4.0+2224+b07ac28e
< 1.18.3-1.module_el8.5.0+81+7dbe79d3
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module_el8.4.0+2224+b07ac28e or 1.18.3-1.module_el8.5.0+81+7dbe79d3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nodejs-nodemon package is a module in the AlmaLinux ecosystem. It is used for automatically restarting Node.js applications when file changes are detected. This package is vulnerable to a specific issue.
Vulnerability Detail
The vulnerability (ALEA-2019:3461) affects the nodejs-nodemon package in AlmaLinux version 8. It was introduced in version 0 and fixed in versions 1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module_el8.4.0+2224+b07ac28e, and 1.18.3-1.module_el8.5.0+81+7dbe79d3. The vulnerability details can be found in the AlmaLinux OSV Database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.4.0+2224+b07ac28e1.18.3-1.module_el8.4.0+2224+b07ac28e -
< 1.18.3-1.module_el8.5.0+81+7dbe79d31.18.3-1.module_el8.5.0+81+7dbe79d3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the nodejs-nodemon package in AlmaLinux version 8 is vulnerable to a specific issue. It is recommended to update the package to one of the fixed versions mentioned above to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The impact of this vulnerability is not mentioned in the provided information.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
The information provided does not mention any known exploits for this vulnerability.
For additional information about this vulnerability, you can refer to the AlmaLinux OSV Database.
The AlmaLinux Release Notes can be found in the References section of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
