There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to
    authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as
    fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,
    even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate
    DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
    therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the
    fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

遠端主機上安裝的 Node.js 版本低於 26.12.1。因此，它會受到 2026 年 10 月 21 日星期三安全性版本公告中所述多個弱點的影響。

  - ZipFile 實作會在 ZIP 標頭驗證失敗後傳回攻擊者控制的前置詞位元組。
    (CVE-2026-106070)

  - 透過萬用字元基數查詢存在權限模型檔案系統過度授予。（CVE-2026-106071）

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Node.js許可模型檔案系統強制執行中的缺陷可能會授予對不符合萬用字元 --allow-fs-read 或 --allow-fs-write 規則的路徑的存取權。當要求的路徑短於萬用字元授權的前置詞時，基數樹狀結構查詢會提前停止比較，並將路徑視為相符項目。舉例來說，
    --allow-fs-read=/etc/passwd.* 也允許讀取 /etc/passwd。這需要萬用字元授權直接位於權限樹狀結構的根目錄下方，例如當它是該範圍的唯一授權時。這是與 CVE-2026-58043不同的根本原因。此弱點會影響 Node.js 26.x。感謝 malikhamzaiqbal 報告此漏洞，並感謝 jasnell 修復它。（CVE-2026-106071）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

远程主机上安装的 Node.js 版本低于 26.12.1。因此，如 2026 年 10 月 21 日星期三安全发布公告所述，受到多个漏洞的影响。

  - ZipFile 实现在 ZIP 标头验证失败后返回攻击者控制的前缀字节。
    (CVE-2026-106070)

  - 存在通过通配符 radix 查找造成的权限模型文件系统过度授权。（CVE-2026-106071）

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 权限模型文件系统强制执行Node.js缺陷可授予对不匹配通配符 --allow-fs-read 或 --allow-fs-write 规则的路径的访问权限。当请求的路径比通配符授予的前缀短时，radix 树查找会提早停止比较并将路径视为匹配。例如，
    --allow-fs-read=/etc/passwd.* 还允许读取 /etc/passwd。这要求通配符授予位于权限树的根目录下，例如，当它是该范围的唯一授予时。这是与 CVE-2026-58043不同的根本原因。此漏洞影响 Node.js 26.x。感谢 malikhamzaiqbal 报告此漏洞，并感谢 jasnell 修复此漏洞。（CVE-2026-106071）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートホストにインストールされている Node.js のバージョンは、26.12.1 より前のものです。したがって、2026年10月21日水曜日のセキュリティリリースアドバイザリに記載されているとおり、複数の脆弱性の影響を受けます。

  - ZipFile の実装が、ZIP ヘッダー検証に失敗した後に、攻撃者がコントロールするプレフィックスバイトを返します。
    (CVE-2026-106070)

  - ワイルドカード基数検索による権限モデルファイルシステムの過剰付与が存在します。(CVE-2026-106071)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Node.js許可モデルファイルシステム実施における欠陥により、ワイルドカード --allow-fs-read または --allow-fs-write ルールに一致しないパスへのアクセス権が付与される可能性があります。リクエストされたパスがワイルドカード付与のプレフィックスより短い場合、基数木検索は比較を早期に停止し、パスを一致として扱います。例えば、
    --allow-fs-read=/etc/passwd.* は、/etc/passwd の読み取りも許可します。これには、ワイルドカード付与がアクセス許可ツリーのルートの直接下にある必要があります (たとえば、ワイルドカード付与がその範囲の唯一の付与である場合)。これは CVE-2026-58043とは異なる根本原因です。この脆弱性はNode.js 26.xに影響します。この脆弱性を報告してくれた malikhamzaiqbal 氏と、修正してくれた jasnell 氏に感謝の意を表します。(CVE-2026-106071)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The version of Node.js installed on the remote host is prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory.

  - The ZipFile implementation returns attacker-controlled prefix bytes after a failed ZIP header validation.
    (CVE-2026-106070)

  - A Permission Model filesystem over-grant exists via wildcard radix lookup. (CVE-2026-106071)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a     wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a     wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example,
    --allow-fs-read=/etc/passwd.* also allows reading /etc/passwd. This requires the wildcard grant to sit     directly under the root of the permission tree, for example when it is the only grant for that scope. This     is a different root cause from CVE-2026-58043. This vulnerability affects Node.js 26.x. Thank you, to     malikhamzaiqbal for reporting this vulnerability and thank you jasnell for fixing it. (CVE-2026-106071)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
370488	Node.js 26.x < 26.12.1 多個弱點	Nessus	Misc.	2026/10/22	2026/10/23	low
371327	Linux Distros 未修補弱點：CVE-2026-106071	Nessus	Misc.	2026/10/23	2026/10/23	critical
370488	Node.js 26.x < 26.12.1 多种漏洞	Nessus	Misc.	2026/10/22	2026/10/23	low
371327	Linux Distros 未修补的漏洞：CVE-2026-106071	Nessus	Misc.	2026/10/23	2026/10/23	critical
370488	Node.js 26.x < 26.12.1 複数の脆弱性	Nessus	Misc.	2026/10/22	2026/10/23	low
371327	Linux Distros のパッチ未適用の脆弱性: CVE-2026-106071	Nessus	Misc.	2026/10/23	2026/10/23	critical
370488	Node.js 26.x < 26.12.1 Multiple Vulnerabilities	Nessus	Misc.	2026/10/22	2026/10/23	low
371327	Linux Distros Unpatched Vulnerability : CVE-2026-106071	Nessus	Misc.	2026/10/23	2026/10/23	critical

检测

插件搜索

high

high

low

critical

low

critical

low

critical

low

critical