Node.js 14 Bug Fix and Enhancement Update
Summary
ALEA-2020:5101: nodejs:14 bug fix and enhancement update. Affects nodejs-nodemon across 2 version ranges.
< 2.0.3-1.module_el8.4.0+2521+c668cc9f
< 2.0.3-1.module_el8.5.0+85+79a7b441
Fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f or 2.0.3-1.module_el8.5.0+85+79a7b441, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This vulnerability affects the following packages: nodejs-nodemon and nodejs-packaging. The vulnerability allows an attacker to execute arbitrary code on a system running a vulnerable version of Node.js. The issue has been fixed in the latest upstream version (14.15.0). The vulnerability was introduced in the initial release of the affected packages and has been addressed in subsequent updates.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 2.0.3-1.module_el8.4.0+2521+c668cc9f2.0.3-1.module_el8.4.0+2521+c668cc9f -
< 2.0.3-1.module_el8.5.0+85+79a7b4412.0.3-1.module_el8.5.0+85+79a7b441
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the affected packages to the fixed versions as soon as possible.
Conclusion
In conclusion, this vulnerability in Node.js can be mitigated by updating the affected packages to the fixed versions. It is important to keep software dependencies up to date to ensure the security and stability of your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
This vulnerability allows an attacker to execute arbitrary code on a system running a vulnerable version of Node.js.
To fix this vulnerability, update the affected packages to the fixed versions: nodejs-nodemon (2.0.3-1.module_el8.4.0+2521+c668cc9f or later) and nodejs-packaging (23-3.module_el8.5.0+254+b4526b16 or later).
There is no known workaround for this vulnerability. It is recommended to update the affected packages to the fixed versions.
You can find more information about this vulnerability in the AlmaLinux OSV Database advisory: https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALEA-2020:5101.json
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
