Critical Security Update for nodejs-nodemon: Denial of Service Vulnerability
Summary
ALSA-2026:52841: Important: nodejs-nodemon security update. Affects nodejs-nodemon versions < 3.1.14-3.el10_2. Fixed in 3.1.14-3.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nodejs-nodemon is a development tool designed to automatically restart Node.js applications when file changes are detected. It simplifies the development process by eliminating the need for manual restarts, allowing developers to focus on coding. However, a recent vulnerability has been identified that could potentially lead to a Denial of Service (DoS) attack, affecting applications that rely on this package.
Vulnerability Detail
The vulnerability, identified as CVE-2026-69152, originates from the brace-expansion package used within nodejs-nodemon. It allows for the creation of unbounded intermediate arrays, which can lead to excessive resource consumption and ultimately result in a Denial of Service. This means that an attacker could exploit this flaw to crash the application or make it unresponsive, severely impacting the availability of the service.
How To Fix
Minimum fixed version
3.1.14-3.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input to the brace-expansion functionality or avoid using features that trigger this vulnerability until you can apply the patch. However, the best course of action is to update to the fixed version as soon as possible.
Conclusion
The nodejs-nodemon package has a critical vulnerability that can lead to Denial of Service attacks. It is crucial for developers to update to the latest patched version to ensure the security and availability of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for nodejs-nodemon →
FAQ
nodejs-nodemon is a tool that automatically restarts Node.js applications when file changes are detected, streamlining the development process.
CVE-2026-69152 refers to a specific vulnerability in the brace-expansion package used by nodejs-nodemon that can lead to Denial of Service attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
Failing to address this vulnerability could result in your application becoming unresponsive or crashing, leading to service downtime and potential data loss.
Yes, you can limit the input to the brace-expansion functionality or avoid using features that trigger this vulnerability until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
