Critical Security Flaw in Node.js-nodemon and Node.js-packaging: Unauthorized Access and Denial of Service
Summary
RLSA-2026:62583: Important: nodejs:24 security update. Affects nodejs-nodemon across 2 version ranges.
< 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
< 0:3.1.14-2.module+el8.10.0+40278+50b003a3
Fixed in 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e or 0:3.1.14-2.module+el8.10.0+40278+50b003a3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and has a rich ecosystem of packages. The affected packages, nodejs-nodemon and nodejs-packaging, are essential tools for Node.js development, providing features for automatic application restarts and package management. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js include unauthorized filesystem access due to a flaw in the Permission Model (CVE-2026-58043), remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846), and a heap-use-after-free issue in HTTP/2 handling that can lead to denial of service (CVE-2026-56848). These vulnerabilities can allow attackers to exploit the system, leading to unauthorized access, service interruptions, and potential data loss.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e0:3.1.14-2.module+el8.10.0+40277+b1b3f89e -
< 0:3.1.14-2.module+el8.10.0+40278+50b003a30:3.1.14-2.module+el8.10.0+40278+50b003a3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to the affected services or disabling HTTP/2 features until the updates can be applied. Additionally, monitor your application for unusual activity that may indicate exploitation attempts.
Conclusion
In summary, the recent vulnerabilities in Node.js packages nodejs-nodemon and nodejs-packaging pose significant security risks. It is crucial to update these packages to their patched versions to mitigate potential threats. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without requiring signup.
The vulnerabilities can lead to unauthorized filesystem access, remote memory exhaustion, and denial of service, potentially compromising application security and availability.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to gain unauthorized access or disrupt services.
If you cannot update the packages right away, implement workarounds such as restricting access to affected services and monitoring for unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
