diff --git a/.gitignore b/.gitignore
index a221390..83db316 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@
 /nodemon-v2.0.3-bundled.tar.gz
 /nodemon-v2.0.7-bundled.tar.gz
 /nodemon-v2.0.15-bundled.tar.gz
+/nodemon-v2.0.19-bundled.tar.gz
+/nodemon-v2.0.20-bundled.tar.gz
diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec
index 5b0b3dc..a7ef5bb 100644
--- a/nodejs-nodemon.spec
+++ b/nodejs-nodemon.spec
@@ -5,7 +5,7 @@
 %global enable_tests 0
 
 Name:          nodejs-%{npm_name}
-Version:       2.0.15
+Version:       2.0.20
 Release:       1%{?dist}
 Summary:       Simple monitor script for use during development of a node.js app
 License:       MIT
@@ -73,6 +73,10 @@ npm run test
 %{_bindir}/nodemon
 
 %changelog
+* Wed Nov 09 2022 Jan Staněk <jstanek@redhat.com> - 2.0.20-1
+- Rebase to 2.0.20
+  Resolves: CVE-2022-3517
+
 * Tue Nov 30 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 2.0.15-1
 - Resolves: RHBZ#2005419
 - Resolves CVE-2020-28469
diff --git a/sources b/sources
index d56b4f7..c6c601d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (nodemon-v2.0.15-bundled.tar.gz) = 7a187493cd376940397c3f0a3bff04f56089c7b9335ab3b1a74cf5fe27a027876c155143c1a3fe636fc83d4df2194def9b58b6228880bf9e10e7646ef3e51e1d
+SHA512 (nodemon-v2.0.20-bundled.tar.gz) = d5da874cf3712bfe77bbed0eb0ecb4c8aec19b4cbba965c659c5eaefa86c6bec9063bd134a1268f739a287bad82b0eeaf912db22a4f0c1fb28645728ba5ac864