The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61377 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)


    Bug Fix(es) and Enhancement(s):

      * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-220543)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61376 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3521-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3557-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 22.23.2, 24.18.1, 26.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, July 29, 2026 Security Releases advisory.

  - A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the     synchronous node:zlib APIs, causing the process to crash. Repeated exploitation of this condition can     result in a denial of service. Impact: Thank you, to byvini for reporting this vulnerability and thank you     RafaelGSS for fixing it. (CVE-2026-58045)

  - A flaw in Node.js HTTP/2 handling can let retained header blocks evade maxSessionMemory limits and cause     remote memory exhaustion. Impact: Thank you, to leduckhuong for reporting this vulnerability and thank you     mcollina for fixing it. (CVE-2026-56846)

  - A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. Impact: Thank you, to     hahahkim for reporting this vulnerability and thank you mcollina for fixing it. (CVE-2026-56848)

  - A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries. Under --permission, an attacker who is granted access to one path can abuse radix-tree prefix     boundary handling to read from or write to paths outside the intended filesystem allowlist. Impact: Thank     you, to sy2n0 for reporting this vulnerability and thank you RafaelGSS for fixing it. (CVE-2026-58043)

  - A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client certificates.
    Impact: Thank you, to yottt for reporting this vulnerability and thank you RafaelGSS for fixing it.
    (CVE-2026-56850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61383 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the     synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are     affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability     affects Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58045)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21545-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23130-1 advisory.

    Update to 22.23.2.

    - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of     SSRF and trust-       boundary checks (bsc#1272882).
    - CVE-2026-56846: HTTP/2 retained headers can bypass `maxSessionMemory` limits (bsc#1272941).
    - CVE-2026-56847: permission model allows trace events to write outside the `allowlist` (bsc#1272949).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58039: permission model allows process reports to write outside the `allowlist` (bsc#1272950).
    - CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: `dns.resolveAny()` can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: `node:zlib` sync APIs can crash on spoofed `TypedArray` length (bsc#1272948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits     exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who     passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and     event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the     recursion work. (CVE-2026-13149)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the     Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,     and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,     stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject     CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the     upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is     unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from     user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and     CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length     header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,     from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can     return a partial response with a mismatched framing header, close the socket early, and have the retry     interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as     proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to     downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the     retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder     that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and     8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0     up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and     entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie     attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and     an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications     that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope     session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,     HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-16729)

    A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before     check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial     of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches     sqlite3_value_type() with a NULL sqlite3_value pointer. (CVE-2026-50812)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace     Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security     boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client     certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname     verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects     Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than     256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling     to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects     Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-     can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-     on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce     hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and     parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a     checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make     no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)

    Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha     function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value     that triggers the function's regex replacement and string-manipulation logic,  causing excessive CPU     consumption and potentially stalling or crashing the process. (CVE-2026-9496)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4248-1 advisory.

    - CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a     multipart/form-data request       (bsc#1236258).
    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from     previous       operations and lead to exposure of in-process secrets (bsc#1256570).
    - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an     unhandled error       (bsc#1256573).
    - CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when `async_hooks.createHook()` is     enabled can       lead to crash (bsc#1256574).
    - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
    - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to     incorrect response       delivery (bsc#1268479).
    - CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding     (bsc#1268477).
    - CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-     Cookie header       (bsc#1268481).
    - CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames     (bsc#1268482).
    - CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using     it as the       Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
    - CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
    - CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes     (bsc#1273591).
    - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error     handling paths       and can cause a denial of service (bsc#1256576).
    - CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
    - CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery     (bsc#1260463).
    - CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
    - CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
    - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to     resource       exhaustion (bsc#1256848).
    - CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS     (bsc#1259853).
    - CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication     bypass due to       resolver and verifier hostname normalization mismatch (bsc#1268593).
    - CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames     (bsc#1268618).
    - CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-     sensitive hostname       matching (bsc#1268605).
    - CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation     in resolver       bindings (bsc#1268606).
    - CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
    - CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
    - CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads     to       unauthorized connections (bsc#1268608).
    - CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
    - CVE-2026-48937: servers keep accepting data even after sending a `GOAWAY` frame (bsc#1268555).
    - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
    - CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
    - CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
    - CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
    - CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
    - CVE-2026-58043: Permission Model path matching can over-grant filesystem access (bsc#1272943).
    - CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
    - CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).

    Changes for nodejs18:

    - upgraded embedded undici to 6.28.0.
    - upgraded embedded nghttp2 to 1.69.0.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2059 advisory.

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits     exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who     passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and     event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the     recursion work. (CVE-2026-13149)

    undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to     before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive,     such as private set to an empty value, can be stored in the default shared cache and later served to a     different caller with the same cache key, disclosing private response bodies and headers including Set-     Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified     one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending     on the consumer's error handling, can terminate the process. Both issues affect applications using the     cache interceptor in shared mode, including the default configuration. The issues are fixed in undici     7.29.0 and 8.9.0. (CVE-2026-13697)

    undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-     cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to     before 8.9.0, the parser either drops the directive or stores a field name with literal quote characters,     so the cache decision fails to recognize the qualification and the response is stored. In shared-cache     mode, this lets a response containing one user's authenticated data be served from cache to a later     caller, including an unauthenticated one, when both requests resolve to the same cache key. It affects     applications that enable the cache interceptor in shared mode, forward Authorization headers upstream, and     receive cacheable responses with qualified directives padded with whitespace around the equals sign. This     is the whitespace-around-equals variant that the fix for CVE-2026-9678 did not normalize, and it is fixed     in undici 7.29.0 and 8.9.0. (CVE-2026-14643)

    undici does not validate the type property of a duck-typed blob-like request body before using it as the     Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,     and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request,     stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject     CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the     upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is     unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from     user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and     CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-15157)

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length     header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0,     from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can     return a partial response with a mismatched framing header, close the socket early, and have the retry     interceptor assemble a body of a different length while the original Content-Length stays attached.
    Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as     proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to     downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the     retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder     that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and     8.9.0. (CVE-2026-16728)

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0     up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and     entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie     attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and     an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications     that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope     session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure,     HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0,     7.29.0, and 8.9.0. (CVE-2026-16729)

    node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended     header's size= record (and other PAX overrides) to the next header entry of any type, including     intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX     extended header (x) describes the next file entry, not the intermediary extension headers that may sit     between the x header and the file it annotates. Because node-tar lets the PAX size override the byte     length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to     every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed     tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single     crafted archive yields a different set of members under node-tar than under the reference tar tools. An     attacker can use this to hide a member from one parser while it is visible to another, which defeats     security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner     that lists entries with one library while a downstream step extracts with another) This vulnerability is     fixed in 7.5.16. (CVE-2026-53655)

    HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace     Logs Outside `--allow-fs-write`.This can lead to confidentiality impact or bypass of the intended security     boundary under affected configurations.This vulnerability affects Node.js **22.x**, **24.x**, and
    **26.x**. (CVE-2026-56847)

    A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while     nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual     TLS (mTLS) client identities to be reused across requests configured with different client     certificates.This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside
    --allow-fs-write paths.

    This can lead to confidentiality impact or bypass of the intended security boundary under affected     configurations. (CVE-2026-58039)

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname     verification across identity policies (incomplete fix of CVE-2026-48934).This vulnerability affects     Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodesqlite-sqltagstore-     iterator-replay-can-re-execute-writes-cve-2026-58041---medium (CVE-2026-58041)

    A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than     256 A records.

    Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix     boundaries.Under `--permission`, an attacker who is granted access to one path can abuse boundary handling     to read from or write to paths outside the intended filesystem allowlist.This vulnerability affects     Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-     can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)

    NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-     on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit     PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as     normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version     7.5.18. (CVE-2026-59871)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce     hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and     parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU.
    This issue is fixed in version 7.5.19. (CVE-2026-59873)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a     checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make     no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
    (CVE-2026-59874)

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL     bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach     fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version     7.5.17. (CVE-2026-59875)

    CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61386 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62583 advisory.

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)
      * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
      * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:97855 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation     (CVE-2026-48617)

    * nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)

    * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

    * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling     (CVE-2026-48930)

    * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

    * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

    * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

    * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

    * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling     (CVE-2026-48615)

    * nodejs: Node.js: Local server can be started without network permission via Permission API flaw     (CVE-2026-48936)

    * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch     (CVE-2026-48618)

    * undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives     (CVE-2026-13697)

    * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw     (CVE-2026-58043)

    * nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)

    * nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions     (CVE-2026-56847)

    * nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw     (CVE-2026-56850)

    * nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)

    * nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)

    * nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)

    * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

    * nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)

    * nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator     (CVE-2026-58041)

    * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

    * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation     (CVE-2026-85152)

    * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options     (CVE-2026-84961)

    * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
342136	AlmaLinux 10 : nodejs24 (ALSA-2026:61377)	Nessus	Alma Linux Local Security Checks	2026/9/1	2026/10/26	high
342137	AlmaLinux 10 : nodejs22 (ALSA-2026:61376)	Nessus	Alma Linux Local Security Checks	2026/9/1	2026/10/26	high
333281	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3521-1)	Nessus	SuSE Local Security Checks	2026/8/7	2026/8/26	medium
334718	SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:3557-1)	Nessus	SuSE Local Security Checks	2026/8/12	2026/8/26	medium
330668	Node.js 22.x < 22.23.2 / 24.x < 24.18.1 / 26.x < 26.5.1 Multiple Vulnerabilities (Wednesday, July 29, 2026 Security Releases).	Nessus	Misc.	2026/7/29	2026/10/9	high
342183	AlmaLinux 9 : nodejs:22 (ALSA-2026:61383)	Nessus	Alma Linux Local Security Checks	2026/9/1	2026/10/26	high
331079	Linux Distros Unpatched Vulnerability : CVE-2026-58045	Nessus	Misc.	2026/7/30	2026/11/6	medium
335109	openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:21545-1)	Nessus	SuSE Local Security Checks	2026/8/13	2026/8/26	medium
335502	SUSE SLES16 Security Update : nodejs22 (SUSE-SU-2026:23130-1)	Nessus	SuSE Local Security Checks	2026/8/15	2026/8/26	medium
337205	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/8/26	critical
347901	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2026:4248-1)	Nessus	SuSE Local Security Checks	2026/9/18	2026/9/23	critical
333039	Photon OS 5.0: Nodejs PHSA-2026-5.0-92-0942	Nessus	PhotonOS Local Security Checks	2026/8/6	2026/11/3	high
337228	Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/8/25	critical
342161	AlmaLinux 9 : nodejs:24 (ALSA-2026:61386)	Nessus	Alma Linux Local Security Checks	2026/9/1	2026/10/26	high
342596	AlmaLinux 8 : nodejs:24 (ALSA-2026:62583)	Nessus	Alma Linux Local Security Checks	2026/9/3	2026/10/26	high
378742	RHEL 9 : nodejs:26 (RHSA-2026:97855)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/11	critical

检测

插件搜索

high

high

medium

medium

high

high

medium

medium

medium

critical

critical

high

critical

high

high

critical