Critical Security Update for nodejs-nodemon and nodejs-packaging: Addressing CVE-2025-31498 and CVE-2025-3277
Summary
RLSA-2025:7433: Important: nodejs:22 security update. Affects nodejs-nodemon across 2 version ranges.
< 0:3.0.1-1.module+el9.5.0+31770+0da7192d
< 0:3.0.1-1.module+el9.5.0+31785+5534beb0
Fixed in 0:3.0.1-1.module+el9.5.0+31770+0da7192d or 0:3.0.1-1.module+el9.5.0+31785+5534beb0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely utilized for server-side development due to its non-blocking, event-driven architecture. The packages 'nodejs-nodemon' and 'nodejs-packaging' are essential tools within the Node.js ecosystem, providing developers with utilities for automatic application restarts and packaging Node.js applications, respectively. However, recent vulnerabilities have been identified that could compromise the security of applications relying on these packages.
Vulnerability Detail
The vulnerabilities stem from two critical issues: a use-after-free error in the c-ares library (CVE-2025-31498) and an integer overflow in SQLite (CVE-2025-3277). The use-after-free vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code. The integer overflow in SQLite may lead to unexpected behavior, including application crashes or data corruption. Both vulnerabilities pose significant risks to the integrity and security of applications built on Node.js.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.0.1-1.module+el9.5.0+31770+0da7192d0:3.0.1-1.module+el9.5.0+31770+0da7192d -
< 0:3.0.1-1.module+el9.5.0+31785+5534beb00:3.0.1-1.module+el9.5.0+31785+5534beb0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updates cannot be applied, consider isolating the affected applications from untrusted inputs and limiting their exposure to potential attacks until the patches are applied.
Conclusion
The recent vulnerabilities in 'nodejs-nodemon' and 'nodejs-packaging' pose significant risks to applications built on Node.js. It is crucial to apply the recommended updates to mitigate these risks and ensure the security of your applications. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for nodejs-nodemon →
FAQ
CVE-2025-31498 is a use-after-free vulnerability in the c-ares library, while CVE-2025-3277 is an integer overflow issue in SQLite, both affecting Node.js applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for these vulnerabilities is 7.3, indicating a high level of severity.
If you cannot update immediately, consider implementing security measures to limit exposure and isolate affected applications until patches can be applied.
The Rocky Enterprise Software Foundation and Red Hat are responsible for maintaining and securing the Node.js packages in Rocky Linux.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
