RHSA-2026:61374: Important: nodejs-nodemon security update
Important: nodejs-nodemon security update
Other sources
Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.Security Fix(es): brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejs-nodemonto a version that resolves this vulnerability.Fixed in 3.1.14-3.el10_0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-69152
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
The affected component is nodemon, a development-time wrapper that watches files and restarts Node.js applications. Deployments using nodemon to monitor application directories are the relevant exposure; the provided data does not establish exposure for applications run directly with node.
What is the security impact of the underlying issue?
The listed flaw, CVE-2026-69152, is a denial-of-service issue in brace-expansion caused by unbounded intermediate arrays. It also bypasses the mitigation for CVE-2026-14257.
Which Red Hat platforms are covered by this update?
The advisory lists Red Hat Enterprise Linux update channels for x86_64, ARM 64, IBM z Systems, and Power little endian, including specified four-year update/support and Extended Update Support offerings. The affected package is redhat/nodejs-nodemon.