Critical Remote Crash Vulnerability in nodejs-nodemon and nodejs-packaging
Summary
RLSA-2025:8467: Important: nodejs:22 security update. Affects nodejs-nodemon across 2 version ranges.
< 0:3.0.1-1.module+el9.5.0+31770+0da7192d
< 0:3.0.1-1.module+el9.5.0+31785+5534beb0
Fixed in 0:3.0.1-1.module+el9.5.0+31770+0da7192d or 0:3.0.1-1.module+el9.5.0+31785+5534beb0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. The affected packages, nodejs-nodemon and nodejs-packaging, are essential tools for Node.js developers. Nodemon automatically restarts the Node.js application when file changes are detected, enhancing development efficiency. Node.js packaging provides the necessary tools for managing Node.js modules and dependencies. However, both packages are vulnerable to a critical issue that could lead to remote crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2025-23166, originates from a flaw in the SignTraits::DeriveBits() function within Node.js. This flaw allows an attacker to exploit the application, potentially causing it to crash remotely. The ramifications of this vulnerability are severe, as it could lead to service disruptions and loss of availability for applications relying on these packages. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 0:3.0.1-1.module+el9.5.0+31770+0da7192d0:3.0.1-1.module+el9.5.0+31770+0da7192d -
< 0:3.0.1-1.module+el9.5.0+31785+5534beb00:3.0.1-1.module+el9.5.0+31785+5534beb0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider disabling the affected features of the application that utilize these packages until the update can be applied. Additionally, monitor application logs for any unusual behavior that may indicate exploitation attempts.
Conclusion
The nodejs-nodemon and nodejs-packaging packages are affected by a critical vulnerability that could lead to remote crashes. It is crucial to update these packages to their patched versions to mitigate the risk. Users are encouraged to monitor their applications and take necessary actions to ensure security.
See every vulnerability recorded for nodejs-nodemon →
FAQ
CVE-2025-23166 is a critical vulnerability in Node.js that allows remote crashes via the SignTraits::DeriveBits() function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
The vulnerability could lead to remote crashes of applications, resulting in service disruptions and loss of availability.
You can update the affected packages using the command: sudo dnf update nodejs-nodemon nodejs-packaging.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
