This update for nodejs6 fixes the following issues :

CVE-2020-8174: Fixed multiple memory corruption in napi_get_value_string_*() (bsc#1172443).

CVE-2020-7598: Fixed an issue which could have tricked minimist into adding or modifying properties of Object.prototype (bsc#1166916).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2849 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2847 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-228:02 advisory.

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)
      * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)
      * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)
      * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-219:03 advisory.

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)
      * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)
      * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)
      * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)
      * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2992 advisory.

  - cri-o: infra container reparented to systemd following OOM Killer killing it's conmon (CVE-2019-14891)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion     (CVE-2020-8552)

  - kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2992 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * cri-o: A flaw was found in cri-o that can result in container management (conmon) processes being killed     if a workload process triggers an out-of-memory (OOM) condition for the cgroup. (CVE-2019-14891)

    * nodejs-minimist: Prototype pollution allows adding or modifying properties of Object.prototype using a     `constructor` or `__proto__` payload. (CVE-2020-7598)

    * kubernetes: Use of unbounded 'client' label in apiserver_request_total allows repeated, crafted HTTP     requests to exhaust available memory and cause a crash. (CVE-2020-8552)

    * kubernetes: A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services     exposed on localhost ports and gain privileges or access confidential information for any services     listening on localhost ports that are not protected by authentication. (CVE-2020-8558)

    * proglottis/gpgme: A use-after-free vulnerability was found in the Go GPGME wrapper library,     github.com/proglottis/gpgme. (CVE-2020-8945)

    * openshift/console: A flaw allowed text injection on error pages with a crafted URL. (CVE-2020-10715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2852 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (12.18.2).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2362 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties     (CVE-2019-10744)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-760:01 advisory.

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)         nodejs-minimist: prototype pollution allows adding or modifying properties     of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)
    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)     CVE-2020-11080     In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection.
    CVE-2020-7598     minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload.
    CVE-2020-8174     napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and <     14.4.0.
    Modularity name: nodejs     Stream name: 10

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016649 advisory.

    minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_2848 advisory.

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
137623	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:1623-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
138156	RHEL 8 : nodejs:10 (RHSA-2020:2849)	Nessus	Red Hat Local Security Checks	2020/7/7	2024/11/7	high
138169	RHEL 8 : nodejs:12 (RHSA-2020:2847)	Nessus	Red Hat Local Security Checks	2020/7/7	2024/11/7	high
294300	MiracleLinux 7 : rh-nodejs10-nodejs-10.21.0-3.el7 (AXSA:2020-228:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	high
294367	MiracleLinux 7 : rh-nodejs12-nodejs-12.18.2-1.el7 (AXSA:2020-219:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	high
312533	RHCOS 3 : OpenShift Container Platform 3.11 (RHSA-2020:2992)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
139006	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2992)	Nessus	Red Hat Local Security Checks	2020/7/28	2024/11/7	high
138384	RHEL 8 : nodejs:12 (RHSA-2020:2852)	Nessus	Red Hat Local Security Checks	2020/7/13	2025/3/13	high
137064	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:2362)	Nessus	Red Hat Local Security Checks	2020/6/3	2024/11/8	critical
145804	CentOS 8 : nodejs:10 (CESA-2020:2848)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/25	high
291709	MiracleLinux 8 : nodejs:10 (AXSA:2020-760:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/20	high
316190	Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: nodejs-minimist (UTSA-2026-016649)	Nessus	Unity Linux Local Security Checks	2026/5/22	2026/8/28	medium
357557	Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_2848)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

critical

high

high

medium

high