Critical Security Vulnerability in Node.js Package: nodejs-nodemon and nodejs-packaging
Summary
RLSA-2026:73838: Important: nodejs:24 security, bug fix, and enhancement update. Affects nodejs-nodemon versions < 0:3.1.14-3.module+el9.8.0+40281+14cc6568. Fixed in 0:3.1.14-3.module+el9.8.0+40281+14cc6568. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and has a rich ecosystem of packages. The nodejs-nodemon package is a utility that automatically restarts the Node.js application when file changes are detected, enhancing the development workflow. The nodejs-packaging package provides tools for packaging Node.js applications. However, recent vulnerabilities have been identified that could compromise the security and stability of applications relying on these packages.
Vulnerability Detail
The vulnerabilities stem from the undici library used within Node.js, which has several critical issues. These include an authentication bypass due to cross-origin cache poisoning (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool (CVE-2026-84961), and a denial of service via unrequested WebSocket subprotocol (CVE-2026-19534). These vulnerabilities can lead to unauthorized access, data breaches, and service disruptions, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
0:3.1.14-3.module+el9.8.0+40281+14cc6568
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their applications by implementing strict input validation and sanitization to mitigate the risk of exploitation until the packages are updated. Additionally, consider disabling WebSocket features if they are not essential to your application.
Conclusion
In summary, the identified vulnerabilities in the nodejs-nodemon and nodejs-packaging packages pose significant security risks. It is crucial for users to update their packages to the latest patched versions to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The CVSS score for the vulnerabilities is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerabilities can lead to unauthorized access, data breaches, and denial of service, potentially compromising the integrity and availability of your applications.
Yes, implementing strict input validation and sanitization can help reduce the risk of exploitation until the packages are updated.
More details can be found on the CVE pages linked in the vulnerability report, which provide insights into the impact and technical specifics.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
