Moderate Vulnerability in nodejs-nodemon and nodejs-packaging: Use-After-Free in c-ares
Summary
RLSA-2025:7426: Moderate: nodejs:20 security update. Affects nodejs-nodemon across 2 version ranges.
< 0:3.0.1-1.module+el9.5.0+31770+0da7192d
< 0:3.0.1-1.module+el9.5.0+31785+5534beb0
Fixed in 0:3.0.1-1.module+el9.5.0+31770+0da7192d or 0:3.0.1-1.module+el9.5.0+31785+5534beb0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and is known for its event-driven architecture. The packages 'nodejs-nodemon' and 'nodejs-packaging' are essential tools within the Node.js ecosystem, facilitating the development and packaging of Node.js applications. However, recent vulnerabilities have been identified that could compromise the security of applications relying on these packages.
Vulnerability Detail
The vulnerability arises from a use-after-free error in the c-ares library, specifically in the read_answers() function. This flaw can lead to potential exploitation, allowing attackers to execute arbitrary code or cause a denial of service. The vulnerability has been assigned CVE-2025-31498 and carries a CVSS score of 7.0, indicating a moderate severity level. Applications utilizing affected versions of nodejs-nodemon and nodejs-packaging are at risk, particularly those that handle DNS queries.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.0.1-1.module+el9.5.0+31770+0da7192d0:3.0.1-1.module+el9.5.0+31770+0da7192d -
< 0:3.0.1-1.module+el9.5.0+31785+5534beb00:3.0.1-1.module+el9.5.0+31785+5534beb0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, monitor application logs for unusual activity that may indicate an attempted attack.
Conclusion
The identified vulnerability in nodejs-nodemon and nodejs-packaging poses a significant risk to applications using these packages. It is crucial to update to the patched versions to ensure the security of your applications. Regular monitoring and proactive measures can help mitigate potential threats.
See every vulnerability recorded for nodejs-nodemon →
FAQ
The vulnerability is a use-after-free error in the c-ares library, which can lead to arbitrary code execution or denial of service.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for this vulnerability is 7.0, indicating a moderate severity level.
As of now, there are no publicly known exploits, but the vulnerability poses a risk to applications that use the affected packages.
Implement input validation and sanitization as a temporary measure, and monitor your application for any unusual activity.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
