Critical Vulnerability in Node.js-nodemon and Node.js-packaging: Denial of Service Risks
Summary
RLSA-2026:75870: Important: nodejs:22 security update. Affects nodejs-nodemon across 2 version ranges.
< 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
< 0:3.1.14-2.module+el8.10.0+40278+50b003a3
Fixed in 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e or 0:3.1.14-2.module+el8.10.0+40278+50b003a3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and has a rich ecosystem of packages. The affected packages, nodejs-nodemon and nodejs-packaging, are essential for managing Node.js applications and their dependencies. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, compromising the stability and availability of applications built on this platform.
Vulnerability Detail
The vulnerabilities stem from issues in the pacote and undici libraries. Specifically, the pacote library is susceptible to a Denial of Service attack via a crafted spec.rawSpec value in the addGitSha function, while the undici library can be exploited through an unrequested WebSocket subprotocol. These vulnerabilities could allow an attacker to disrupt service, leading to potential downtime and loss of availability for applications relying on these packages.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e0:3.1.14-2.module+el8.10.0+40277+b1b3f89e -
< 0:3.1.14-2.module+el8.10.0+40278+50b003a30:3.1.14-2.module+el8.10.0+40278+50b003a3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider limiting the input to the affected functions or implementing rate limiting on the server to mitigate the impact of potential DoS attacks until the packages can be updated.
Conclusion
In summary, the identified vulnerabilities in nodejs-nodemon and nodejs-packaging pose significant risks of Denial of Service attacks. It is essential to update these packages to their patched versions promptly to ensure the security and availability of applications built on Node.js. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The vulnerability allows for Denial of Service attacks through specific exploits in the pacote and undici libraries.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Exploitation of this vulnerability could lead to service disruptions, making applications unavailable to users.
Yes, implementing input validation and rate limiting can help reduce the risk of a Denial of Service attack until the packages are updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
