The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8468 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02039-1 advisory.

    Update to 20.19.2:

    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

    Other bugfixes:

    - Build with PIE (bsc#1239949)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2025_8514 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772125283 advisory.

  - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass     proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp`     to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js     20.x users prior to the `llhttp` v9 upgrade. (CVE-2025-23167)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers     allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data     from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. (CVE-2025-55131)

  - A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by     triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the     process crashes, enabling a remote denial of service. This primarily affects applications that do not     attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket =>     { socket.on('error', err => { console.log(err) }) }) ``` (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching     `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications     that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become     vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0c2b7a8f32 advisory.

    Update to 20.19.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8514 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02045-1 advisory.

    Update to 20.19.2:

    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

    Other bugfixes:

    - Build with PIE (bsc#1239949)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0462 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-23165:
    In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a     UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results     in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to     a denial of service.

    Impact:
    * This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of     the required \r\n\r\n.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.

    The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772125283 advisory.

  - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass     proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp`     to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js     20.x users prior to the `llhttp` v9 upgrade. (CVE-2025-23167)

  - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are     interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers     allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data     from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data     corruption. While exploitation typically requires precise timing or in-process code execution, it can     become remotely exploitable when untrusted input influences workload and timeouts, leading to potential     confidentiality and integrity impact. (CVE-2025-55131)

  - A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by     triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the     process crashes, enabling a remote denial of service. This primarily affects applications that do not     attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket =>     { socket.on('error', err => { console.log(err) }) }) ``` (CVE-2025-59465)

  - We have identified a bug in Node.js error handling where Maximum call stack size exceeded errors become     uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching     `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications     that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become     vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
    (CVE-2025-59466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 20.19.2, 22.15.1, 22.15.1, 23.11.1, 24.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, May 14, 2025 Security Releases advisory.

  - In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a     UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results     in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to     a denial of service. Impact: Thank you, to Justin Nietzel for reporting and fixing this vulnerability.
    (CVE-2025-23165)

  - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. Impact: Thank you, @panva and @tniessen, for reporting and fixing this     vulnerability. (CVE-2025-23166)

  - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of     the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-     based access controls and submit unauthorized requests. The issue was resolved by upgrading llhttp to     version 9, which enforces correct header termination. Impact: Thank you, to kenballus for reporting this     vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-23167)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0090 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-23165:
    In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`:
    a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This     results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth,     leading to a denial of service.
    Impact:
    * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.
    The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.
    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The version of Tenable.ad installed on the remote host is prior to 3.77.12. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-14 advisory.

  - Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which     makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit     this loop other than killing the thread/process. (CVE-2025-5399) 

  - Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a     network. (CVE-2025-30399)

  - libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified     as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks. (CVE-2025-4947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4261-1 advisory.

    - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a     multipart/form-data request       (bsc#1236258).
    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from     previous       operations and lead to exposure of in-process secrets (bsc#1256570).
    - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an     unhandled error       (bsc#1256573).
    - CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is     enabled can       lead to crash (bsc#1256574).
    - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using     it as the       Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
    - CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
    - CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes     (bsc#1273591).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to     resource       exhaustion (bsc#1256848).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

    Changes for nodejs18:

    - upgraded embedded undici to 6.28.0.
    - upgraded embedded nghttp2 to 1.69.0.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
237726	RHEL 9 : nodejs:20 (RHSA-2025:8468)	Nessus	Red Hat Local Security Checks	2025/6/3	2025/10/9	medium
240594	SUSE SLES15 Security Update : nodejs20 (SUSE-SU-2025:02039-1)	Nessus	SuSE Local Security Checks	2025/6/26	2025/6/26	medium
357049	Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2025_8514)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
361764	Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772125283)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
237405	Fedora 41 : nodejs20 (2025-0c2b7a8f32)	Nessus	Fedora Local Security Checks	2025/5/28	2025/5/28	medium
237750	RHEL 8 : nodejs:20 (RHSA-2025:8514)	Nessus	Red Hat Local Security Checks	2025/6/4	2025/10/9	medium
241098	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2025:02045-1)	Nessus	SuSE Local Security Checks	2025/7/1	2025/7/1	medium
276301	TencentOS Server 3: nodejs:20 (TSSA-2025:0462)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/4	medium
361932	AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772125283)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	high
236766	Node.js 20.x < 20.19.2 / 22.x < 22.15.1 / 22.x < 22.15.1 / 23.x < 23.11.1 / 24.x < 24.0.2 Multiple Vulnerabilities (Wednesday, May 14, 2025 Security Releases).	Nessus	Misc.	2025/5/15	2026/10/9	medium
240278	Alibaba Cloud Linux 3 : 0090: nodejs:20 (ALINUX3-SA-2025:0090)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/6/23	2025/6/23	medium
240522	Photon OS 4.0: Nodejs PHSA-2025-4.0-0820	Nessus	PhotonOS Local Security Checks	2025/6/25	2026/11/2	medium
243057	Tenable.ad < 3.77.12 Multiple Vulnerabilities (TNS-2025-14)	Nessus	Misc.	2025/7/30	2025/7/30	high
348277	SUSE SLES15 Security Update : nodejs18 (SUSE-SU-2026:4261-1)	Nessus	SuSE Local Security Checks	2026/9/19	2026/9/23	critical

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

medium

high

medium

medium

medium

high

critical