This security update addresses CVE-2026-13149, a denial-of-service vulnerability in the `brace-expansion` library used by `nodejs-nodemon`, where specially crafted input can trigger exponential-time complexity, causing the application to hang. The Red Hat advisory rates this as an Important security impact. The update provides patched packages for `nodejs-nodemon` across all supported architectures of Red Hat Enterprise Linux 10.
Red Hat Product Errata RHSA-2026:48032 - Security Advisory Issued: 2026-07-29 Updated: 2026-07-29 RHSA-2026:48032 - Security Advisory Overview Updated Packages Synopsis Important: nodejs-nodemon security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for nodejs-nodemon is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2494813 - CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVEs CVE-2026-13149 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 x86_64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 x86_64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for IBM z Systems 10 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 s390x nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 s390x nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for Power, little endian 10 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 ppc64le nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 ppc64le nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for ARM 64 10 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 aarch64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 aarch64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 aarch64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 s390x nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 ppc64le nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 x86_64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 x86_64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 aarch64 nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 ppc64le nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 SRPM nodejs-nodemon-3.1.14-2.el10_2.src.rpm SHA-256: 4b80bad78b5ae4f515f9f41caa398692085f9341a9714471b9304cf03d2150c2 s390x nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm SHA-256: fa825312cfa7588a3ab4b45fe2c1a333fdd887c07692bd2d4ed827e1e43a63e2 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .