121 matches found
Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_0598)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20200598 advisory. nodejs: HTTP request smuggling using malformed Transfer-Encoding header CVE-2019-15605 nodejs: Remotely trigger an assertion on a TLS server with a malform...
Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_7205)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237205 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 nodejs: permission model improperly protects...
Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging (crlsa-2023_5850)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235850 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Tenable has extracted the preceding description block...
Rocky Linux 9 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging / nodejs-packaging-bundler Multiple Vulnerabilities (crlsa-2023_5849)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235849 advisory. HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 nodejs: integrity checks according to policie...
nodejs:24 security, bug fix, and enhancement update
nodejs 1:24.21.0-1 - Update to version 24.21.0 nodejs-nodemon 3.1.14-3 - Fix CVE-2026-69152 - brace-expansion 3.1.14-2 - Correction to sources for 3.1.14. 3.1.14-1 - Update to version 3.1.14 3.0.3-3 - Keep BR on just npm 3.0.3-2 - Fix BR for nodejs-npm nodejs-packaging 2021.06-6 - Properly handle...
AZL-105089 CVE-2026-102277 affecting package nodejs-nodemon 2.0.3-5
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...
AZL-105096 CVE-2026-102276 affecting package nodejs-nodemon 2.0.3-5
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...
AZL-105092 CVE-2026-102278 affecting package nodejs-nodemon 2.0.3-5
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before...
AZL-103448 CVE-2026-93748 affecting package nodejs-nodemon 2.0.3-5
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...
AZL-103451 CVE-2026-93750 affecting package nodejs-nodemon 2.0.3-5
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...
AZL-103445 CVE-2026-93687 affecting package nodejs-nodemon 2.0.3-5
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...
Oracle Linux 8 : ELSA-2026-62219-0: / nodejs:22 (ELSA-2026-622190)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-622190 advisory. - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-235693 RHEL-235688 RHEL-235662 nodejs-nodemon - Rebase...
Oracle Linux 9 : ELSA-2026-61383-0: / nodejs:22 (ELSA-2026-613830)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-613830 advisory. - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 nodejs-nodemon Tenable...
RHSA-2026:61374 Red Hat Security Advisory: nodejs-nodemon security update
Bulletin has no description...
nodejs:24 security update
nodejs 1:24.19.0-1 - Update to version 24.19.0 nodejs-nodemon 3.1.14-3 - Fix CVE-2026-69152 - brace-expansion 3.1.14-2 - Correction to sources for 3.1.14. 3.1.14-1 - Update to version 3.1.14 3.0.3-3 - Keep BR on just npm 3.0.3-2 - Fix BR for nodejs-npm nodejs-packaging 2021.06-6 - Properly handle...
Important: Red Hat Security Advisory: nodejs-nodemon security update
An update for nodejs-nodemon is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
RHEL 10 : nodejs-nodemon (RHSA-2026:61374)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61374 advisory. Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch th...
AZL-98334 CVE-2026-82417 affecting package nodejs-nodemon 2.0.3-5
Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...
nodejs-nodemon security update
An update is available for nodejs-nodemon. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Simple monitor script for use during development of a node.js app. Fo...