Critical Denial of Service Vulnerability in nodejs-nodemon: Important Security Update Required
Summary
RLSA-2026:7896: Important: nodejs:20 security update. Affects nodejs-nodemon across 3 version ranges.
< 0:3.0.1-1.module+el9.7.0+40017+f0db1785
< 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
< 0:3.0.1-1.module+el9.7.0+40018+a011993d
Fixed in 0:3.0.1-1.module+el9.7.0+40017+f0db1785, 0:3.0.1-1.module+el9.7.0+40022+9ecc286c or 0:3.0.1-1.module+el9.7.0+40018+a011993d, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and has a rich ecosystem of packages. The nodejs-nodemon package is a utility that automatically restarts the Node.js application when file changes in the directory are detected. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, compromising the stability and availability of applications using this package.
Vulnerability Detail
The vulnerabilities identified in nodejs-nodemon stem from issues in its dependencies, particularly minimatch and nghttp2. These vulnerabilities allow attackers to exploit specially crafted glob patterns and malformed HTTP/2 frames, leading to Denial of Service conditions. The specific CVEs associated with this vulnerability include CVE-2026-21710, CVE-2026-26996, CVE-2026-27135, and CVE-2026-27904. The potential ramifications include application crashes and unavailability, which can severely impact user experience and service reliability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.0.1-1.module+el9.7.0+40017+f0db17850:3.0.1-1.module+el9.7.0+40017+f0db1785 -
< 0:3.0.1-1.module+el9.7.0+40018+a011993d0:3.0.1-1.module+el9.7.0+40018+a011993d -
< 0:3.0.1-1.module+el9.7.0+40022+9ecc286c0:3.0.1-1.module+el9.7.0+40022+9ecc286c
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider limiting the input to the minimatch patterns and ensuring that the application does not process untrusted input. Additionally, monitor your application for unusual behavior that could indicate an attempted DoS attack.
Conclusion
In summary, the identified vulnerabilities in nodejs-nodemon pose significant risks to application stability and availability. It is crucial to update to the latest patched version to safeguard against potential Denial of Service attacks. Regular monitoring and proactive security measures are recommended to maintain application integrity.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The main vulnerabilities include Denial of Service via crafted glob patterns and malformed HTTP/2 frames, among others.
While the primary risk is Denial of Service, which affects availability, there is no direct indication of data loss associated with this vulnerability.
If immediate updates are not possible, implement input validation and monitoring to mitigate potential attacks until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
