It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-749 advisory.

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to     restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files     that they do not have explicit read access to. (CVE-2024-22018)

    A security flaw in Node.js  allows a bypass of network import restrictions.By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security.Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.

    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.
    (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5814 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

    * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)

    * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2543-1 advisory.

    Update to 20.15.1:

    - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
    - CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
    - CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
    - CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
    - CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

    Changes in 20.15.0:

    - test_runner: support test plans
    - inspector: introduce the --inspect-wait flag
    - zlib: expose zlib.crc32()
    - cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

    Changes in 20.14.0

    - src,permission: throw async errors on async APIs
    - test_runner: support forced exit

    Changes in 20.13.1:

    - buffer: improve base64 and base64url performance
    - crypto: deprecate implicitly shortened GCM tags
    - events,doc: mark CustomEvent as stable
    - fs: add stacktrace to fs/promises
    - report: add --report-exclude-network option
    - src: add uv_get_available_memory to report and process
    - stream: support typed arrays
    - util: support array of formats in util.styleText
    - v8: implement v8.queryObjects() for memory leak regression testing
    - watch: mark as stable

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5814 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
    * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
    * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0765 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-22018:
    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used.
    This flaw arises from an inadequate permission model that fails to restrict file stats through the     fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit     read access to.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-22020:
    A security flaw in Node.js  allows a bypass of network import restrictions.
    By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system     security.
    Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
    Exploiting this flaw can violate network import security, posing a risk to developers and servers.

    CVE-2024-28863:
    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders.

    CVE-2024-36137:
    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.

    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8726:01 advisory.

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
      * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
      * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-11 (Node.js: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to     restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files     that they do not have explicit read access to. This vulnerability affects all users using the experimental     permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the     permission model is an experimental feature of Node.js. (CVE-2024-22018)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the nodejs package has been released.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5815 advisory.

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

    * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)

    * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-768 advisory.

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to     restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files     that they do not have explicit read access to. (CVE-2024-22018)

    A security flaw in Node.js  allows a bypass of network import restrictions.By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security.Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.

    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.
    (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0247 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-39331:
    A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The     new path traversal vulnerability arises because the implementation does not protect itself against the     application overwriting built-in utility functions with user-defined implementations.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2023-39332:
    Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js     environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer`     `Uint8Array` objects.
    This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability     follows the same pattern using `Uint8Array` instead of `Buffer`.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-21890:
    The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example:
    ```
    --allow-fs-read=/home/node/.ssh/*.pub     ```     will ignore `pub` and give access to everything after `.ssh/`.
    This misleading documentation affects all users using the experimental permission model in Node.js 20 and     Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-21891:
    Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-21896:
    The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-22017:
    setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid().
    This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0     and Node.js 21.

    CVE-2024-22018:
    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used.
    This flaw arises from an inadequate permission model that fails to restrict file stats through the     fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit     read access to.
    This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    CVE-2024-22020:
    A security flaw in Node.js  allows a bypass of network import restrictions.
    By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system     security.
    Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
    Exploiting this flaw can violate network import security, posing a risk to developers and servers.

    CVE-2024-28863:
    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders.

    CVE-2024-36137:
    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.
    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8725:01 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
      * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
      * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
      * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
210001	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-749)	Nessus	Amazon Linux Local Security Checks	2024/10/31	2025/12/18	medium
210568	RHEL 8 : nodejs:20 (RHSA-2024:5814)	Nessus	Red Hat Local Security Checks	2024/11/8	2025/12/18	medium
202587	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:2543-1)	Nessus	SuSE Local Security Checks	2024/7/18	2024/9/9	high
206217	AlmaLinux 8 : nodejs:20 (ALSA-2024:5814)	Nessus	Alma Linux Local Security Checks	2024/8/26	2025/12/18	medium
276162	TencentOS Server 3: nodejs:20 (TSSA-2024:0765)	Nessus	Tencent Local Security Checks	2025/11/20	2026/3/11	medium
293563	MiracleLinux 9 : nodejs:20 (AXSA:2024-8726:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
236407	GLSA-202505-11 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2025/5/14	2025/5/17	critical
247533	Linux Distros Unpatched Vulnerability : CVE-2024-22018	Nessus	Misc.	2025/8/10	2025/9/10	low
204232	Photon OS 5.0: Nodejs PHSA-2024-5.0-0318	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/9/9	high
207299	Rocky Linux 9 : nodejs:20 (RLSA-2024:5815)	Nessus	Rocky Linux Local Security Checks	2024/9/16	2024/9/16	medium
211368	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-768)	Nessus	Amazon Linux Local Security Checks	2024/11/14	2025/12/18	medium
236198	Alibaba Cloud Linux 3 : 0247: nodejs:20 (ALINUX3-SA-2024:0247)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
293326	MiracleLinux 8 : nodejs:20 (AXSA:2024-8725:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

high

medium

medium

medium

critical

low

high

medium

medium

critical

medium