This update for nodejs12 fixes the following issues :

nodejs12 was updated to 12.18.4 LTS :

  - CVE-2020-8201: Fixed an HTTP Request Smuggling due to     CR-to-Hyphen conversion (bsc#1176605).

  - CVE-2020-8252: Fixed a buffer overflow in realpath     (bsc#1176589).

  - CVE-2020-15095: Fixed an information leak through log     files (bsc#1173937).

Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0548 advisory.

  - npm: sensitive information exposure through logs (CVE-2020-15095)

  - nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

  - nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

  - nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

  - nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  - libuv: buffer overflow in realpath (CVE-2020-8252)

  - nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  - nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1479:01 advisory.

    * libuv: buffer overflow in realpath (CVE-2020-8252)
      * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)
      * nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)
      * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
      * nodejs-dot-prop: prototype pollution (CVE-2020-8116)
      * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
      * npm: sensitive information exposure through logs (CVE-2020-15095)
      * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)
      * nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)
      * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0094 advisory.

    This advisory aggregates security fixes for the libuv SRPM in CIQ LTS 8.6. It addresses 2 CVEs:
    CVE-2024-24806, CVE-2020-8252.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Node.js reports :

Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201) Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.

Impacts :

- All versions of the 14.x and 12.x releases line Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251) Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.

Impacts :

- All versions of the 14.x release line fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252) libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Impacts :

- All versions of the 10.x release line

- All versions of the 12.x release line

- All versions of the 14.x release line before 14.9.0

The remote host is affected by the vulnerability described in GLSA-202009-15 (libuv: Buffer overflow)

    libuv used an incorrect buffer size for paths, causing a buffer       overflow.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the nodejs10 package has been released.

This update for nodejs10 fixes the following issues :

nodejs10 was updated to 10.22.1 LTS :

  - CVE-2020-8252: Fixed a buffer overflow in realpath     (bsc#1176589).

  - CVE-2020-15095: Fixed an information leak through log     files (bsc#1173937).

Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5086 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.4).
    (BZ#1878550, BZ#1888291, BZ#1888298)

    Security Fix(es):

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

    * npm: Sensitive information exposure through logs (CVE-2020-15095)

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0099 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-8252:
    The implementation of realpath in libuv  10.22.1,  12.18.4, and  14.9.0 used within Node.js incorrectly     determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256     bytes.

    CVE-2021-22918:
    Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is     used to convert strings to ASCII. The pointer p is read and increased without checking whether it is     beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information     disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0099 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2020-8252:
    The implementation of realpath in libuv  10.22.1,  12.18.4, and  14.9.0 used within Node.js incorrectly     determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256     bytes.

    CVE-2021-22918:
    Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is     used to convert strings to ASCII. The pointer p is read and increased without checking whether it is     beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information     disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0521 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.23.1).

    Security Fix(es):

    * libuv: buffer overflow in realpath (CVE-2020-8252)

    * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS     (CVE-2020-7754)

    * nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

    * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs-dot-prop: prototype pollution (CVE-2020-8116)

    * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

    * npm: sensitive information exposure through logs (CVE-2020-15095)

    * nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

    * nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

    * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
143665	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2020:2812-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/5/11	high
146802	CentOS 8 : nodejs:10 (CESA-2021:0548)	Nessus	CentOS Local Security Checks	2021/2/24	2024/1/19	critical
294327	MiracleLinux 7 : rh-nodejs10-nodejs-10.23.1-2.el7 (AXSA:2021-1479:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
357914	Rocky Linux 8.6 [CIQ] Security Update: libuv / libuv-debuginfo / libuv-debugsource / libuv-devel Multiple Vulnerabilities (ciqsa-2026_0094)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	high
140627	FreeBSD : Node.js -- September 2020 Security Releases (4ca5894c-f7f1-11ea-8ff8-0022489ad614)	Nessus	FreeBSD Local Security Checks	2020/9/17	2022/5/12	high
141065	GLSA-202009-15 : libuv: Buffer overflow	Nessus	Gentoo Local Security Checks	2020/9/30	2021/6/3	high
141476	Photon OS 1.0: Nodejs10 PHSA-2020-1.0-0331	Nessus	PhotonOS Local Security Checks	2020/10/16	2024/7/22	high
143657	SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2020:2829-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/6	high
143819	SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2020:2823-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/5	high
170332	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:5086)	Nessus	Red Hat Local Security Checks	2023/1/23	2024/11/8	high
236671	Alibaba Cloud Linux 3 : 0099: libuv (ALINUX3-SA-2022:0099)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
239682	TencentOS Server 3: libuv (TSSA-2022:0099)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
165111	RHEL 7 : rh-nodejs10-nodejs (RHSA-2021:0521)	Nessus	Red Hat Local Security Checks	2022/9/15	2024/11/7	critical

检测

插件搜索

high

critical

critical

high

high

high

high

high

high

high

high

high

critical