Critical Security Vulnerability in nodejs-nodemon: Authentication Bypass and Denial of Service
Summary
RLSA-2026:74085: Important: nodejs:24 security, bug fix, and enhancement update. Affects nodejs-nodemon across 2 version ranges.
< 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
< 0:3.1.14-2.module+el8.10.0+40278+50b003a3
Fixed in 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e or 0:3.1.14-2.module+el8.10.0+40278+50b003a3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. The nodejs-nodemon package is a utility that automatically monitors for changes in your source code and restarts your server, enhancing the development workflow. However, recent vulnerabilities have been identified in this package that could lead to serious security issues.
Vulnerability Detail
The vulnerabilities in nodejs-nodemon stem from issues in the undici library, which is used for HTTP/1.1 client functionality. These include an authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool due to dropped connect options (CVE-2026-84961), and a Denial of Service attack via unrequested WebSocket subprotocol (CVE-2026-19534). These vulnerabilities could allow attackers to exploit the application, leading to unauthorized access and service disruptions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e0:3.1.14-2.module+el8.10.0+40277+b1b3f89e -
< 0:3.1.14-2.module+el8.10.0+40278+50b003a30:3.1.14-2.module+el8.10.0+40278+50b003a3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider implementing strict input validation and origin checks in your application to mitigate the risk of exploitation until the package can be updated.
Conclusion
In summary, the nodejs-nodemon package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is crucial to ensure the security of your applications. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The CVSS score of the vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
The vulnerabilities could lead to unauthorized access to sensitive data, service disruptions, and potential exploitation of the application by malicious actors.
Yes, implementing strict input validation and origin checks can help mitigate the risk until the package is updated.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about the issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
