There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to
    authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as
    fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses,
    even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate
    DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
    therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the
    fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**. (CVE-2026-105483)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP
    endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`,
    `2130706433` or `127.1`. `tls.checkServerIdentity()` did not classify these hosts as IP addresses, but
    normalized them to their canonical form and matched the result against the certificate DNS names. A
    certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the
    same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric
    DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such
    as glibc. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-106072)

  - A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was
    sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that
    destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O.
    If an unsolicited response has already reached the socket but has not been read yet when the socket is
    handed to a new request, for example because the event loop was busy with synchronous work, the guard is
    removed without seeing it and the data is parsed as the response to the new request. This vulnerability
    affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-105481)

  - A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the
    dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only
    covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string,
    resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any
    error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it
    with dns.resolve*() can act on records for a different name than the one they validated. This
    vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-105482)

  - A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a
    different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal
    with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the
    WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the
    connection is made through the operating system resolver, which on some platforms such as macOS reads it
    as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate
    issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
    (CVE-2026-106069)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`,
    `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-
    snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an
    API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every
    process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs
    and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and
    values issued by one process can be predicted by observing another. This vulnerability affects Node.js
    **26.x**, **24.x**, and **22.x**. (CVE-2026-106074)

远程主机上安装的 Node.js 版本低于 22.x22.23.4、 24.x24.22.1或26.x26.12.1低于 。因此，如 2026 年 10 月 21 日星期三安全发布公告所述，受到多个漏洞的影响。

  - Brotli 解码器中的越界写入可允许远程代码执行。（CVE-2026-111497）

  - dns.resolve 会截断包含空字符的名称。（CVE-2026-105482）

  - 主机松散解析为 IP 地址时，可绕过 TLS 证书主机名验证。
    (CVE-2026-106069)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機上安裝的 Node.js 版本在 22.x 之前 22.23.4或 24.x24.22.1之前 。26.x26.12.1 因此，它會受到 2026 年 10 月 21 日星期三安全性版本公告中所述多個弱點的影響。

  - Brotli 解碼器中的越界寫入可以允許遠端程式碼執行。（CVE-2026-111497）

  - dns.resolve 會截斷包含 NUL 字元的名稱。（CVE-2026-105482）

  - 當主機鬆散解析為 IP 位址時，可以略過 TLS 憑證主機名稱驗證。
    (CVE-2026-106069)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Node.js加密中的一個缺陷會導致 crypto.randomUUID（）、crypto.randomUUIDv7（） 和 crypto.randomInt（） 使用的內部熵快取儲存到使用者空間啟動快照 （--build-snapshot） 和使用 useSnapshot 建置的單一可執行應用程式中。如果在建置快照時呼叫這些函式中的任何一個，或依賴這些函式的 API （例如 URL.createObjectURL），則從該快照啟動的每個處理程序都會傳回相同的值，直到快取重新填入為止：最多 127 個 UUID 和大約 1,000 個 randomInt（） 值。預期為唯一的識別碼可能會在處理程序之間發生衝突，並且可以透過觀察另一個處理程序來預測一個處理程序發出的值。此弱點會影響 Node.js 26.x、 24.x和 22.x。感謝 gesposito 報告此漏洞，並感謝 panva 修復它。（CVE-2026-106074）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Node.js crypto 中的一个缺陷造成 crypto.randomUUID（）、crypto.randomUUIDv7（） 和 crypto.randomInt（） 使用的内部熵缓存保存到用户空间启动快照 （--build-snapshot） 和使用 useSnapshot 构建的单个可执行应用程序中。如果在构建快照时调用这些函数中的任何一个或依赖于它们的 API，例如 URL.createObjectURL（），则从该快照启动的每个进程都会返回相同的值，直到重新填充缓存：最多 127 个 UUID 和大约 1,000 个 randomInt（） 值。预期为唯一的标识符可能会在进程之间发生冲突，并且可以通过观察另一个进程来预测由一个进程发出的值。此漏洞影响 Node.js 26.x、 和 24.x22.x。感谢 gesposito 报告此漏洞，并感谢 panva 修复此漏洞。（CVE-2026-106074）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートホストにインストールされている Node.js のバージョンは、22.23.4 より前の 22.x、24.x より前の 24.22.1、または 26.12.1 より前の 26.x です。したがって、2026年10月21日水曜日のセキュリティリリースアドバイザリに記載されているとおり、複数の脆弱性の影響を受けます。

  - Brotli デコーダーの領域外書き込みにより、リモートコードの実行が許可される可能性があります。(CVE-2026-111497)

  - dns.resolve は、NULL 文字を含む名前を切り捨てます。(CVE-2026-105482)

  - ホストが IP アドレスに緩やかに解決する場合、TLS 証明書のホスト名の検証をバイパスする可能性があります。
    (CVE-2026-106069)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Node.js crypto の欠陥により、crypto.randomUUID()、crypto.randomUUIDv7()、および crypto.randomInt() が使用する内部エントロピーキャッシュが、ユーザーランド起動スナップショット(--build-snapshot)および useSnapshot で構築された単一実行可能アプリケーションに保存されます。スナップショットのビルド中にこれらの関数のいずれか、またはそれらに依存する API(例: URL.createObjectURL) が呼び出された場合、そのスナップショットから開始されたすべてのプロセスは、キャッシュが再入力されるまで同じ値 (最大 127 UUID と約 1,000 randomInt() 値) を返します。一意であることが期待される識別子はプロセス間で衝突する可能性があり、あるプロセスによって発行された値は、別のプロセスを観察することで予測できます。この脆弱性は、Node.js 26.x、 24.x、 22.xに影響します。この脆弱性を報告してくれた gesposito 氏、および修正してくれた panva 氏に感謝の意を表します。(CVE-2026-106074)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`,     `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-     snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an     API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every     process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs     and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and     values issued by one process can be predicted by observing another. This vulnerability affects Node.js
    **26.x**, **24.x**, and **22.x**. (CVE-2026-106074)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Node.js installed on the remote host is 22.x prior to 22.23.4, 24.x prior to 24.22.1, or 26.x prior to 26.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, October 21, 2026 Security Releases advisory.

  - An out-of-bounds write in the Brotli decoder can permit remote code execution. (CVE-2026-111497)

  - dns.resolve truncates names containing a NUL character. (CVE-2026-105482)

  - TLS certificate hostname verification can be bypassed when the host loosely resolves to an IP address.
    (CVE-2026-106069)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477149	Alpine: multiple nodejs packages: security update to 22.23.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477199	Chainguard: multiple nodejs-22 packages: security update to 22.23.4-r0	Tenable Cloud Security	Chainguard Local Security Checks	2026/10/24	2026/10/24	medium
477145	Alpine: multiple nodejs packages: security update to 24.22.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477149	Alpine: multiple nodejs packages: security update to 22.23.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/10/23	2026/10/23	high
477199	Chainguard: multiple nodejs-22 packages: security update to 22.23.4-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/10/24	2026/10/24	medium
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 多个漏洞	Nessus	Misc.	2026/10/22	2026/10/23	critical
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 多個弱點	Nessus	Misc.	2026/10/22	2026/10/23	critical
370552	Linux Distros 未修補弱點：CVE-2026-106074	Nessus	Misc.	2026/10/22	2026/10/24	medium
370552	Linux Distros 未修补的漏洞：CVE-2026-106074	Nessus	Misc.	2026/10/22	2026/10/24	medium
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 複数の脆弱性	Nessus	Misc.	2026/10/22	2026/10/23	critical
370552	Linux Distros のパッチ未適用の脆弱性: CVE-2026-106074	Nessus	Misc.	2026/10/22	2026/10/24	medium
370552	Linux Distros Unpatched Vulnerability : CVE-2026-106074	Nessus	Misc.	2026/10/22	2026/10/24	medium
370490	Node.js 22.x < 22.23.4 / 24.x < 24.22.1 / 26.x < 26.12.1 Multiple Vulnerabilities	Nessus	Misc.	2026/10/22	2026/10/23	critical

检测

插件搜索

high

high

medium

high

high

medium

critical

critical

medium

medium

critical

medium

medium

critical